CVE catalog
CVE-2026-41711
Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4
- Severity
- Medium · CVSS 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.30% · Oct 25, 2026
A flaw was found in Spring Data Commons. Applications using this component may be vulnerable to a Denial of Service (DoS) attack. A remote attacker could exploit this by sending specially crafted Sort parameters, leading to a StackOverflowException and causing the application to become unavailable. Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters A flaw was found in Spring Data Commons. Crafted Sort parameter strings can cause unbounded recursion in PropertyPath resolution, leading to a StackOverflowError and denial of service. Exploitation requires the application to expose endpoints accepting Sort parameters from untrusted sources without validation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | spring_data_commons | Not reported | 2.7.20 | fixed |
| Cpe | spring_data_commons | Not reported | Not reported | unknown |
| Cpe | spring_data_commons | Not reported | 3.3.17 | fixed |
| Cpe | spring_data_commons | Not reported | 3.4.15 | fixed |
| Cpe | spring_data_commons | Not reported | 3.5.12 | fixed |
| Cpe | spring_data_commons | Not reported | 4.0.6 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | spring_data_commons | cpe | Not reported | 2.7.20 | Not reported | Not reported | Not reported |
| Cpe | spring_data_commons | cpe | Not reported | 3.3.17 | Not reported | Not reported | Not reported |
| Cpe | spring_data_commons | cpe | Not reported | 3.4.15 | Not reported | Not reported | Not reported |
| Cpe | spring_data_commons | cpe | Not reported | 3.5.12 | Not reported | Not reported | Not reported |
| Cpe | spring_data_commons | cpe | Not reported | 4.0.6 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: