CVE-2018-1274: Spring Data Commons Property Path Parser Vulnerability
Summary
CVE-2018-1274: Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. Affects org.springframework.data:spring-data-commons across 2 version ranges.
< 1.13.11
>= 2.0.0, < 2.0.6
Fixed in 1.13.11 or 2.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a library that provides a set of utilities and abstractions for working with data repositories in Spring applications. It is commonly used in Maven projects with the package name 'org.springframework.data:spring-data-commons'. This vulnerability affects versions 1.13 to 1.13.10 and 2.0 to 2.0.5, as well as older unsupported versions. The vulnerability arises from a property path parser that allows for unlimited resource allocation. This can be exploited by an unauthenticated remote attacker to launch denial of service attacks, causing excessive CPU and memory consumption.
Vulnerability Detail
The property path parser vulnerability in Spring Data Commons allows an attacker to abuse the resource allocation mechanism, leading to denial of service attacks. By issuing requests against Spring Data REST endpoints or endpoints using property path parsing, an attacker can cause excessive CPU and memory usage, effectively rendering the system unresponsive. This vulnerability poses a significant risk to the availability and performance of affected applications.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.111.13.11 -
>= 2.0.0, < 2.0.62.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided fix by upgrading to the patched versions of Spring Data Commons.
Conclusion
The property path parser vulnerability in Spring Data Commons can be exploited by an attacker to launch denial of service attacks. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Spring Data Commons. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
Spring Data Commons is a library that provides utilities and abstractions for working with data repositories in Spring applications. It simplifies the development of data access layers by providing common functionality and reducing boilerplate code.
Versions 1.13 to 1.13.10 and 2.0 to 2.0.5 of Spring Data Commons are affected by this vulnerability. Older unsupported versions may also be vulnerable.
This vulnerability allows an attacker to launch denial of service attacks, causing excessive CPU and memory consumption. This can result in system unresponsiveness and impact the availability and performance of affected applications.
No, authentication is not required. An unauthenticated remote attacker can exploit this vulnerability.
No, there are no known workarounds for this vulnerability. It is necessary to upgrade to the fixed versions of Spring Data Commons.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
