CVE-2026-41695: Spring Data Commons DoS Vulnerability

CVE-2026-41695 Overview

CVE-2026-41695 is a denial of service vulnerability in Spring Data Commons. Applications become vulnerable when attacker-controlled property path strings reach the MappingContext property path resolution logic. Processing these crafted strings causes resource exhaustion, degrading availability of affected services.

The issue is classified under CWE-400: Uncontrolled Resource Consumption. It affects Spring Data Commons versions 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, and 3.4.0 through 3.4.14. Spring projects built on top of Spring Data Commons inherit this exposure when they expose property path parameters to untrusted input.

Critical Impact
Unauthenticated network attackers can trigger resource exhaustion in Spring Data Commons applications, leading to denial of service against availability-critical workloads.

Affected Products

Spring Data Commons 4.0.0 through 4.0.5
Spring Data Commons 3.5.0 through 3.5.11
Spring Data Commons 3.4.0 through 3.4.14

Discovery Timeline

2026-06-10 - CVE-2026-41695 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41695

Vulnerability Analysis

Spring Data Commons provides the MappingContext abstraction used by Spring Data modules to resolve property paths against domain entities. When an application accepts user-supplied strings and forwards them into property path resolution, the parser performs work proportional to the structure of the input. Crafted inputs cause the resolver to consume excessive CPU and memory.

The outcome is a denial of service condition. The vulnerability does not expose data or allow modification of state; impact is limited to availability. Common exposure points include sorting parameters, projection selectors, query-by-example properties, and any framework-bound parameter that maps to a PropertyPath.

Review the Spring Security Advisory for CVE-2026-41695 for vendor-confirmed details.

Root Cause

The root cause is uncontrolled resource consumption during property path parsing. The resolver does not bound the cost of processing pathological input strings. Attacker-controlled property names propagate from request parameters into MappingContext without sufficient length, complexity, or rate constraints.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits HTTP requests containing crafted property path strings to endpoints that bind these values to Spring Data operations. Repeated requests amplify CPU and memory pressure, exhausting application resources and producing a service outage.

No verified public proof-of-concept code is available at the time of writing. Consult the vendor advisory for technical specifics.

Detection Methods for CVE-2026-41695

Indicators of Compromise

Sustained high CPU utilization in Java application processes correlated with inbound HTTP traffic to Spring Data-backed endpoints.
Heap growth, frequent full garbage collection cycles, and OutOfMemoryError events in application logs.
Request parameters containing unusually long or deeply nested property path strings such as repeated dot-separated tokens.

Detection Strategies

Inspect HTTP access logs for query parameters mapping to sort, projection, or property selectors with abnormal length or repetition.
Profile JVM threads during incidents to identify time spent in PropertyPath and MappingContext resolution methods.
Correlate web application firewall (WAF) telemetry with backend latency spikes to identify malicious request patterns.

Monitoring Recommendations

Set alerts on per-endpoint p95 latency and CPU saturation thresholds for services using Spring Data repositories.
Track JVM metrics including heap usage, GC pause duration, and thread pool saturation through APM tooling.
Enable request size and parameter length logging at the reverse proxy or API gateway.

How to Mitigate CVE-2026-41695

Immediate Actions Required

Upgrade Spring Data Commons to a fixed release line above 4.0.5, 3.5.11, or 3.4.14 as published in the vendor advisory.
Audit application code for endpoints that bind user input directly to property path parameters and add server-side validation.
Apply rate limiting and request size caps at the API gateway for any endpoint forwarding parameters to Spring Data queries.

Patch Information

Upgrade to a patched Spring Data Commons release as documented in the Spring Security Advisory for CVE-2026-41695. Verify transitive dependencies pulled in by Spring Boot, Spring Data JPA, Spring Data MongoDB, and other Spring Data modules to ensure they resolve to fixed versions.

Workarounds

Restrict accepted property path values to an allowlist of known entity properties at the controller layer.
Enforce maximum length and depth limits on property path strings before they reach repository methods.
Deploy WAF rules that reject requests containing oversized or malformed sort and projection parameters.

bash

# Example Maven dependency override to a fixed version
# Replace the version with the patched release from the vendor advisory
mvn dependency:tree | grep spring-data-commons
./mvnw versions:use-dep-version -Dincludes=org.springframework.data:spring-data-commons -DdepVersion=<patched-version> -DforceVersion=true