CVE-2026-41721: Spring Data Commons DoS Vulnerability

CVE-2026-41721 Overview

CVE-2026-41721 is a Denial of Service (DoS) vulnerability in Spring Data Commons. The flaw affects applications that enable Spring Data Web Support together with Controller methods annotated with @ProjectedPayload. An attacker can send a specially crafted HTTP request that forces the application to allocate excessive memory, exhausting available resources. The issue is categorized under [CWE-400: Uncontrolled Resource Consumption].

The vulnerability impacts multiple Spring Data Commons release branches, including the 2.7.x, 3.0.x through 3.5.x, and 4.0.x series. Spring published a security advisory tracking the issue under CVE-2026-41721.

Critical Impact
Unauthenticated remote attackers can trigger memory exhaustion in vulnerable Spring applications, resulting in service availability loss.

Affected Products

Spring Data Commons 4.0.0 through 4.0.5
Spring Data Commons 3.5.0 through 3.5.11, 3.4.0 through 3.4.14, 3.3.0 through 3.3.16
Spring Data Commons 3.2.0 through 3.2.15, 3.1.0 through 3.1.14, 3.0.0 through 3.0.15, and 2.7.0 through 2.7.19

Discovery Timeline

2026-06-10 - CVE-2026-41721 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41721

Vulnerability Analysis

The vulnerability resides in Spring Data Commons, a foundational module that provides shared infrastructure across Spring Data projects. When an application enables Spring Data Web Support, the framework registers handlers that translate inbound HTTP payloads into domain projections. Controllers using the @ProjectedPayload annotation rely on this infrastructure to bind request data into projection interfaces backed by proxies.

Attackers exploit the projection binding path by submitting a crafted HTTP request whose structure forces the framework to allocate large amounts of heap memory. Sustained or repeated requests drive the JVM toward OutOfMemoryError conditions, causing the application to become unresponsive. The attack requires no authentication and no user interaction.

The condition is classified as uncontrolled resource consumption, where input size and structure are not bounded before allocation decisions are made.

Root Cause

The root cause is insufficient validation of payload structure during projection binding in Spring Data Web Support. The framework does not enforce upper bounds on the resources consumed when materializing a @ProjectedPayload from an attacker-controlled HTTP request, allowing one request to dictate large memory allocations.

Attack Vector

The attack vector is network-based. A remote attacker sends a crafted HTTP request to any endpoint whose Controller method accepts a parameter annotated with @ProjectedPayload. High attack complexity reflects the need to shape the payload so that projection binding triggers excessive allocation. No verified public proof-of-concept code is available at the time of publication. See the Spring Security Advisory for CVE-2026-41721 for vendor-confirmed technical details.

Detection Methods for CVE-2026-41721

Indicators of Compromise

Sudden spikes in JVM heap usage or OutOfMemoryError entries in application logs correlated with inbound HTTP requests.
Repeated POST or PUT requests to endpoints whose Controllers use @ProjectedPayload, particularly with unusually large or deeply nested payloads.
Sustained latency increases or HTTP 5xx error bursts from Spring-based services.

Detection Strategies

Inventory application code for @ProjectedPayload usage and map each occurrence to a public HTTP route.
Inspect web server and reverse-proxy logs for anomalous Content-Length values or repeated requests from a single source against projection-backed endpoints.
Enable JVM heap and garbage-collection telemetry to identify allocation patterns consistent with resource exhaustion attempts.

Monitoring Recommendations

Forward application logs, JVM metrics, and HTTP access logs to a centralized analytics platform for correlation across hosts.
Alert on threshold breaches for heap utilization, GC pause times, and request error rates on Spring services.
Track Spring Data Commons component versions across the fleet to confirm patched releases are deployed.

How to Mitigate CVE-2026-41721

Immediate Actions Required

Identify all applications using Spring Data Commons within the affected version ranges and prioritize remediation for internet-exposed services.
Upgrade Spring Data Commons to a fixed release as listed in the Spring Security Advisory for CVE-2026-41721.
Restrict or rate-limit access to endpoints using @ProjectedPayload until patching is complete.

Patch Information

VMware Spring published remediation guidance in the Spring Security Advisory for CVE-2026-41721. Administrators should upgrade Spring Data Commons to a release outside the affected ranges (2.7.0–2.7.19, 3.0.0–3.0.15, 3.1.0–3.1.14, 3.2.0–3.2.15, 3.3.0–3.3.16, 3.4.0–3.4.14, 3.5.0–3.5.11, 4.0.0–4.0.5) per the advisory.

Workarounds

Disable Spring Data Web Support where it is not required by the application.
Remove or refactor @ProjectedPayload usage on Controller methods that accept untrusted input.
Enforce request size limits at the reverse proxy or web server layer to constrain payload dimensions.
Configure a Web Application Firewall rule to block oversized or malformed JSON bodies targeting projection-backed endpoints.

bash

# Example: enforce a request body size limit in application.properties
spring.servlet.multipart.max-request-size=1MB
server.tomcat.max-http-form-post-size=1MB
server.tomcat.max-swallow-size=1MB