CVE-2026-41695: Spring Data Commons Unbounded Property-Path Cache Vulnerability
Summary
CVE-2026-41695: Spring Data: Unbounded property-path cache keyed by externally-supplied path string. Affects org.springframework.data:spring-data-commons across 3 version ranges.
>= 3.4.0, <= 3.4.13
>= 3.5.0, < 3.5.12
>= 4.0.0, < 4.0.6
Fixed in 3.5.12 or 4.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a key component of the Spring Data project, providing a consistent programming model for data access across various data stores. It simplifies database interactions by offering a unified API for different types of databases, including relational and NoSQL databases. The package allows developers to define data access layers with minimal boilerplate code, enhancing productivity. However, it is susceptible to a vulnerability that can lead to denial of service (DoS) due to unbounded caching of user-supplied property paths.
Vulnerability Detail
The vulnerability arises from the caching mechanism in the PersistentPropertyPathFactory class, where user-supplied dot-paths are cached indefinitely, including invalid paths. This unbounded resource allocation can be exploited by an attacker who sends numerous requests with unique sort parameters, leading to excessive memory consumption and ultimately causing the application to run out of memory (OOM). The caching mechanism does not evict entries, allowing an attacker to create permanent entries for every distinct invalid path string, resulting in a denial of service.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.5.0, < 3.5.123.5.12 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, implement input validation or rate limiting on the incoming requests to prevent excessive unique path submissions. This can help mitigate the risk of an attacker exploiting the vulnerability until the package is updated.
Conclusion
CVE-2026-41695 presents a significant risk to applications using Spring Data Commons due to its unbounded caching of user-supplied property paths. It is crucial to update to the latest patched versions to prevent potential denial of service attacks. Additionally, implementing workarounds such as input validation can provide temporary relief until the update is completed.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
CVE-2026-41695 is a vulnerability in Spring Data Commons that allows for unbounded caching of user-supplied property paths, leading to potential denial of service.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the pom.xml file.
The main consequence is denial of service, where an attacker can cause the application to run out of memory by sending numerous unique requests.
Update your pom.xml file to include the patched version of Spring Data Commons (4.0.6 or 3.5.12) and then rebuild your project.
Yes, implementing input validation or rate limiting on incoming requests can help mitigate the risk until an update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
