CVE-2026-41711: Spring Data Commons Denial of Service Vulnerability Due to StackOverflowException
Summary
CVE-2026-41711: Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS). Affects org.springframework.data:spring-data-commons across 5 version ranges.
< 2.7.19
>= 3.0.0, <= 3.3.16
>= 3.4.0, <= 3.4.14
>= 3.5.0, < 3.5.12
>= 4.0.0, < 4.0.6
Fixed in 2.7.19, 3.5.12 or 4.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a key component of the Spring Framework, providing a consistent data access strategy across various data stores. It simplifies database interactions and enhances productivity by offering a set of abstractions and utilities. However, certain versions of Spring Data Commons are vulnerable to a Denial of Service (DoS) attack, which can lead to application downtime and degraded performance.
Vulnerability Detail
The vulnerability arises from the way Spring Data Commons parses Sort parameters. When malformed or excessively nested Sort parameters are provided, the application may enter a recursive loop, leading to a StackOverflowException. This can cause the application to crash or become unresponsive, effectively denying service to legitimate users. The affected versions include Spring Data Commons 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, and several others down to 2.7.19.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.192.7.19 -
>= 3.5.0, < 3.5.123.5.12 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the complexity of Sort parameters being processed by your application. This can help mitigate the risk of triggering the StackOverflowException until you can apply the patch.
Conclusion
In summary, the CVE-2026-41711 vulnerability in Spring Data Commons poses a significant risk of Denial of Service due to a StackOverflowException when parsing Sort parameters. It is crucial to update to the patched versions to safeguard your applications and ensure continued service availability.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
A Denial of Service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, often by overwhelming it with traffic or exploiting vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If left unaddressed, this vulnerability can lead to application crashes, downtime, and a poor user experience, potentially impacting your business operations.
Yes, versions 4.0.6 and later for 4.x, and 3.5.12 and later for 3.5 are safe and include the necessary fixes for this vulnerability.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
