CVE-2026-41721

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Data Commons

Publication date: 2026-06-10

Last updated on: 2026-06-16

Assigner: VMware

Description

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-16

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-41721

EUVD

EUVD-2026-35902

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	spring_data_commons	From 3.3.0 (inc) to 3.3.17 (exc)
broadcom	spring_data_commons	From 3.4.0 (inc) to 3.4.15 (exc)
broadcom	spring_data_commons	From 3.5.0 (inc) to 3.5.12 (exc)
broadcom	spring_data_commons	From 4.0.0 (inc) to 4.0.6 (exc)
broadcom	spring_data_commons	to 2.7.20 (exc)
broadcom	spring_data_commons	From 3.0.0 (inc) to 3.0.15 (inc)
broadcom	spring_data_commons	From 3.1.0 (inc) to 3.1.14 (inc)
broadcom	spring_data_commons	From 3.2.0 (inc) to 3.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-41721 is a medium-severity vulnerability in Spring Data Commons that can lead to a Denial of Service (DoS) condition.

The issue occurs when Spring Data Web Support is enabled alongside a Controller method using the @ProjectedPayload annotation.

An attacker can exploit this by sending a specially crafted HTTP request that causes the application to allocate excessive memory, potentially crashing the system.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) condition in your application.

Specifically, an attacker can send a specially crafted HTTP request that forces the application to allocate a large amount of memory, which may lead to system crashes or unavailability.

Mitigation Strategies

To mitigate the risk of this vulnerability, you should upgrade Spring Data Commons to one of the fixed versions appropriate for your current version.

Upgrade to version 4.0.6 if you are using any 4.0.x version.
Upgrade to version 3.5.12 if you are using any 3.5.x version.
Upgrade to version 3.4.15 if you are using any 3.4.x version.
Upgrade to version 3.3.17 if you are using any 3.3.x version.
Upgrade to version 2.7.20 if you are using any 2.7.x version.

Note that some fixed versions may require enterprise support.

Hi! I’m here to help you understand CVE-2026-41721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70