CVE-2026-41711 Overview
CVE-2026-41711 is a Denial of Service (DoS) vulnerability in Spring Data Commons. The flaw exists in the parsing logic for Sort parameters and can be triggered by a remote, unauthenticated attacker. A specially crafted Sort input causes a StackOverflowException in the application thread handling the request.
The weakness is classified under [CWE-400] Uncontrolled Resource Consumption. Successful exploitation does not compromise data confidentiality or integrity but disrupts application availability.
Critical Impact
Remote unauthenticated attackers can crash Spring Data Commons-based applications by submitting crafted Sort parameters, resulting in service disruption for any endpoint that binds Sort from request input.
Affected Products
- Spring Data Commons 4.0.0 through 4.0.5
- Spring Data Commons 3.5.0 through 3.5.11, 3.4.0 through 3.4.14, 3.3.0 through 3.3.16, 3.2.0 through 3.2.15, 3.1.0 through 3.1.14, 3.0.0 through 3.0.15
- Spring Data Commons 2.7.0 through 2.7.19
Discovery Timeline
- 2026-06-10 - CVE-2026-41711 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-41711
Vulnerability Analysis
Spring Data Commons provides shared infrastructure for Spring Data modules, including the Sort abstraction that maps request parameters to ordering criteria. Web controllers commonly bind Sort directly from query strings using SortHandlerMethodArgumentResolver or Pageable resolvers.
When the framework parses Sort input, recursive processing of the supplied tokens can exceed the JVM thread stack. An attacker who submits a sufficiently nested or repetitive Sort expression triggers a StackOverflowException inside the request thread. The exception terminates request processing and, depending on container configuration, may degrade the worker pool serving subsequent requests.
The attack requires network access but no authentication or user interaction. High attack complexity reflects the need to craft inputs that exceed the stack depth on the target deployment.
Root Cause
The root cause is unbounded recursion in the Sort parameter parser. The component does not enforce a maximum depth or input length before recursing across user-supplied tokens, leaving the JVM stack as the only limit.
Attack Vector
Exploitation occurs over HTTP against any endpoint that resolves a Sort or Pageable argument from request parameters. The attacker submits a query string containing a Sort value engineered to drive the parser into deep recursion. No credentials, sessions, or CSRF tokens are required when the endpoint is publicly reachable. Refer to the Spring Security advisory for CVE-2026-41711 for vendor-supplied technical details.
Detection Methods for CVE-2026-41711
Indicators of Compromise
- Application logs containing java.lang.StackOverflowError originating from org.springframework.data.domain.Sort or SortHandlerMethodArgumentResolver stack frames.
- Repeated HTTP 500 responses correlated with requests containing unusually long or repetitive sort= query parameters.
- Sudden spikes in thread termination or request timeouts on endpoints that expose Pageable or Sort bindings.
Detection Strategies
- Inspect web access logs for requests with oversized sort parameters or repeated property tokens separated by commas or dots.
- Correlate StackOverflowError exceptions in application logs with the source IP and URI of the triggering request.
- Deploy WAF rules that flag query parameters exceeding a reasonable length threshold for sort fields.
Monitoring Recommendations
- Alert on any StackOverflowError originating from Spring Data packages in centralized logging.
- Track per-endpoint error rates for controllers that accept Sort or Pageable arguments.
- Monitor JVM thread health and request latency on services exposing Spring Data repositories to the public internet.
How to Mitigate CVE-2026-41711
Immediate Actions Required
- Upgrade Spring Data Commons to a fixed maintenance release on your branch (4.0.x, 3.5.x, 3.4.x, 3.3.x, 3.2.x, 3.1.x, 3.0.x, or 2.7.x) as published in the Spring Security advisory.
- Inventory applications that bind Sort or Pageable from request input and prioritize internet-facing services.
- Restrict access to affected endpoints behind authentication or network controls until patches are deployed.
Patch Information
Pivotal/VMware has published fixed versions for all supported Spring Data Commons branches. Consult the Spring Security advisory for CVE-2026-41711 for the exact patched versions corresponding to each maintenance line and apply them through your dependency manager.
Workarounds
- Add a WAF or reverse-proxy rule that rejects sort query parameters exceeding a defined character length or nesting depth.
- Replace direct Sort binding with a custom argument resolver that validates and bounds input before delegating to the Spring resolver.
- Limit JVM thread stack size considerations and rate-limit endpoints exposing Pageable resolution to reduce blast radius.
# Example Maven dependency override to enforce a patched version
mvn dependency:tree -Dincludes=org.springframework.data:spring-data-commons
# Then pin the patched version in pom.xml <dependencyManagement>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
