CVE-2026-41716: Spring Data Commons Heap Exhaustion Vulnerability from Unbounded Property-Lookup Cache
Summary
CVE-2026-41716: Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys. Affects org.springframework.data:spring-data-commons across 5 version ranges.
< 2.7.19
>= 3.3.0, <= 3.3.16
>= 3.4.0, <= 3.4.14
>= 3.5.0, < 3.5.12
>= 4.0.0, < 4.0.6
Fixed in 2.7.19, 3.5.12 or 4.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a core component of the Spring Data project, providing a set of common functionality for data access in Spring applications. It simplifies data access and manipulation by offering a consistent programming model across various data stores. However, it is susceptible to a vulnerability that allows attackers to exploit its internal property-lookup cache, leading to potential heap exhaustion.
Vulnerability Detail
The vulnerability arises from the internal property-lookup cache of Spring Data Commons, which accepts and retains attacker-supplied strings as cache keys indefinitely. This unbounded retention can lead to heap exhaustion, causing the application to consume excessive memory and potentially crash. Attackers can exploit this vulnerability by sending repeated requests with crafted string keys, leading to denial of service (DoS) conditions.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.192.7.19 -
>= 3.5.0, < 3.5.123.5.12 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider limiting the input size or implementing rate limiting on requests to mitigate the risk of heap exhaustion until the package can be updated.
Conclusion
In summary, CVE-2026-41716 is a significant vulnerability in Spring Data Commons that can lead to heap exhaustion through unbounded property-lookup cache retention. It is crucial to update to the latest patched versions to mitigate this risk and ensure application stability.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
CVE-2026-41716 is a vulnerability in Spring Data Commons that allows for heap exhaustion due to unbounded retention of attacker-supplied strings in its property-lookup cache.
Affected versions include Spring Data Commons 2.7.0 through 2.7.19, 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in software using just the pom.xml file. You can also check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, implement input size limitations or rate limiting on requests to reduce the risk of heap exhaustion.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
