CVE-2026-41721: Spring Data Commons Denial of Service via Excessive Memory Allocation
Summary
CVE-2026-41721: Spring Data Commons: Denial of Service via excessive memory allocation in projection binding. Affects org.springframework.data:spring-data-commons across 5 version ranges.
< 2.7.19
>= 3.0.0, <= 3.3.16
>= 3.4.0, <= 3.4.14
>= 3.5.0, < 3.5.12
>= 4.0.0, < 4.0.6
Fixed in 2.7.19, 3.5.12 or 4.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a key component of the Spring Framework that provides support for data access and manipulation. It is widely used in Java applications to simplify database interactions and enhance productivity. The library offers features such as repository support, query derivation, and integration with various data stores. However, it is vulnerable to a Denial of Service (DoS) attack when specific configurations are enabled, particularly when using @ProjectedPayload in conjunction with Spring Data Web Support.
Vulnerability Detail
The vulnerability in Spring Data Commons arises when an attacker sends a specially crafted HTTP request to a Controller method that utilizes @ProjectedPayload. This request can trigger excessive memory allocation, leading to a Denial of Service (DoS) condition. The affected versions include Spring Data Commons 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, and several others. The potential ramifications include application crashes and unavailability, severely impacting user experience and service reliability.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.192.7.19 -
>= 3.5.0, < 3.5.123.5.12 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider disabling Spring Data Web Support or avoiding the use of @ProjectedPayload in your Controller methods to mitigate the risk of this vulnerability.
Conclusion
In summary, CVE-2026-41721 poses a significant risk to applications using Spring Data Commons, particularly when specific configurations are enabled. It is crucial to update to the patched versions or implement workarounds to ensure application stability and security.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
CVE-2026-41721 is a vulnerability in Spring Data Commons that can lead to a Denial of Service (DoS) condition due to excessive memory allocation.
Affected versions include Spring Data Commons 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, and several others.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application's pom.xml at Vulert's playground without signup.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
If you cannot update immediately, consider disabling Spring Data Web Support or avoiding the use of @ProjectedPayload in your Controller methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
