CVE-2026-41695

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Data Commons via Property Path Exhaustion

Publication date: 2026-06-10

Last updated on: 2026-06-27

Assigner: VMware

Description

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-27

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-41695

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	spring_data_commons	From 3.4.0 (inc) to 3.4.15 (exc)
broadcom	spring_data_commons	From 3.5.0 (inc) to 3.5.12 (exc)
broadcom	spring_data_commons	From 4.0.0 (inc) to 4.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-41695 is a denial-of-service vulnerability in Spring Data Commons that occurs when attacker-controlled property path strings are passed to the MappingContext property path resolution.

This vulnerability can be exploited if the targeted domain types contain recursive or deeply nested property graphs, or if attackers submit numerous invalid paths, which leads to resource exhaustion in the application.

It mainly affects applications exposing this functionality to untrusted users, such as those using Spring Data REST.

Impact Analysis

The vulnerability can cause a denial of service by exhausting system resources when processing maliciously crafted property path strings.

This means that an attacker can make the affected application unavailable or unresponsive, potentially disrupting business operations.

Mitigation Strategies

The recommended mitigation is to upgrade Spring Data Commons to the fixed versions: 4.0.6, 3.5.12, or 3.4.15, depending on the branch you are using.

No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-41695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70