CVE-2026-41716: Spring Data Commons DoS Vulnerability

CVE-2026-41716 Overview

CVE-2026-41716 is a denial-of-service vulnerability in Spring Data Commons. The framework's internal property-lookup cache accepts attacker-supplied strings as cache keys and retains them permanently. Repeated requests with unique property names cause the cache to grow without bound, exhausting the Java Virtual Machine (JVM) heap.

The flaw maps to CWE-770: Allocation of Resources Without Limits or Throttling. An unauthenticated remote attacker can trigger the condition through normal application endpoints that pass user input into Spring Data property resolution.

Critical Impact
Remote unauthenticated attackers can exhaust application memory and force JVM crashes by repeatedly submitting unique property names against any endpoint backed by Spring Data.

Affected Products

Spring Data Commons 2.7.0 through 2.7.19
Spring Data Commons 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11
Spring Data Commons 4.0.0 through 4.0.5

Discovery Timeline

2026-06-10 - CVE-2026-41716 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41716

Vulnerability Analysis

Spring Data Commons provides repository abstractions for Java applications. The framework parses property paths from method names, query parameters, and sort expressions to map them to underlying entity fields. To accelerate repeated lookups, Spring Data maintains an internal cache keyed by the property string.

The cache lacks both a size cap and an eviction policy. When user-controlled input reaches the property resolver, each unique string permanently consumes heap space. Attackers send requests containing high-entropy property names to populate the cache without limit.

Once the heap fills, the JVM begins issuing OutOfMemoryError exceptions. Garbage collection cycles increase in frequency and duration, degrading response times before the application terminates. The attack requires no authentication and consumes no special privileges.

Root Cause

The root cause is missing input validation on cache keys combined with an unbounded Map used for property metadata storage. Spring Data trusts the property names supplied through public API surfaces and treats every distinct string as a new cache entry.

Attack Vector

Attackers target endpoints that expose Spring Data query derivation, dynamic sorting, or projection parameters. A typical exploit involves repeated HTTP requests where the sort parameter or a dynamic projection field name contains randomized values such as sort=field_<random>,asc. Each request grows the cache until the JVM exhausts memory.

No exploitation code example is provided. Refer to the Spring Security Advisory CVE-2026-41716 for vendor technical details.

Detection Methods for CVE-2026-41716

Indicators of Compromise

Sustained heap growth in JVM telemetry without corresponding business traffic increases
Frequent full garbage collection cycles followed by java.lang.OutOfMemoryError: Java heap space entries in application logs
HTTP access logs showing repeated requests with high-cardinality sort, projection, or property-name parameters from a small set of source addresses

Detection Strategies

Inspect web application firewall (WAF) logs for query parameters containing randomized field names targeting Spring Data endpoints
Correlate JVM heap metrics with request volume to identify memory growth that outpaces traffic
Audit application dependency manifests for vulnerable Spring Data Commons versions using software composition analysis (SCA) tooling

Monitoring Recommendations

Enable JVM HeapDumpOnOutOfMemoryError to capture forensic artifacts when the cache exhausts memory
Track the size of Spring Data internal caches through Micrometer or JMX metrics where available
Alert on abnormal request rates against endpoints that accept property names from clients

How to Mitigate CVE-2026-41716

Immediate Actions Required

Identify all applications using Spring Data Commons versions listed in the advisory and prioritize internet-facing services
Apply the patched releases published by the Spring project as soon as they pass internal validation
Restrict accepted property names on public endpoints to an allowlist of known entity fields

Patch Information

Spring published fixed releases addressing the unbounded cache behavior. Consult the Spring Security Advisory CVE-2026-41716 for the exact patched versions and upgrade guidance for each maintained branch (2.7.x, 3.3.x, 3.4.x, 3.5.x, 4.0.x).

Workarounds

Validate sort and projection parameters server-side against a static list of permitted property names before they reach Spring Data
Place a rate limit on endpoints that derive queries from user input to slow cache growth
Increase JVM heap size only as a stopgap; this delays rather than prevents exhaustion

bash

# Example Maven dependency override to pin a patched Spring Data Commons version
mvn dependency:tree -Dincludes=org.springframework.data:spring-data-commons
# Update the version property in pom.xml to the fixed release listed in the advisory
# <spring-data-commons.version>FIXED_VERSION</spring-data-commons.version>