CVE-2026-41721
Received Received - Intake
Denial of Service in Spring Data Commons

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: VMware

Description
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-41721
EUVD
EUVD-2026-35902
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
vmware spring_data_commons From 2.7.0 (inc) to 4.0.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41721 is a medium-severity vulnerability in Spring Data Commons that can lead to a Denial of Service (DoS) condition.

The issue occurs when Spring Data Web Support is enabled alongside a Controller method using the @ProjectedPayload annotation.

An attacker can exploit this by sending a specially crafted HTTP request that causes the application to allocate excessive memory, potentially crashing the system.

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) condition in your application.

Specifically, an attacker can send a specially crafted HTTP request that forces the application to allocate a large amount of memory, which may lead to system crashes or unavailability.

Mitigation Strategies

To mitigate the risk of this vulnerability, you should upgrade Spring Data Commons to one of the fixed versions appropriate for your current version.

  • Upgrade to version 4.0.6 if you are using any 4.0.x version.
  • Upgrade to version 3.5.12 if you are using any 3.5.x version.
  • Upgrade to version 3.4.15 if you are using any 3.4.x version.
  • Upgrade to version 3.3.17 if you are using any 3.3.x version.
  • Upgrade to version 2.7.20 if you are using any 2.7.x version.

Note that some fixed versions may require enterprise support.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart