What is the CVSS score of CVE-2026-41695?

CVE-2026-41695 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Data Commons are affected by CVE-2026-41695?

Spring Data Commons versions 3.4.x through 4.0.x contain a high-severity denial-of-service vulnerability that allows remote attackers to exhaust server resources without authentication.

How to fix or mitigate CVE-2026-41695?

Within 24 hours: Inventory all applications using Spring Data Commons 3.4.x, 3.5.x, or 4.0.x and map their exposure to untrusted input. Within 7 days: Deploy input validation to sanitize property path strings, implement rate limiting on parsing operations, and isolate affected services from untrusted networks where feasible. Within 30 days: Plan migration to Spring Data Commons versions outside the affected range (pre-3.4.x or post-4.0.x when patched), monitor vendor advisories for patch release, and test mitigations in production-like environments.

Spring Data Commons CVE-2026-41695

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-10 security@vmware.com

Denial Of Service Java Spring Data Commons

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 00:32 vuln.today

DescriptionCVE.org

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.

Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.

AnalysisAI

Denial of service in Spring Data Commons 3.4.x, 3.5.x, and 4.0.x allows remote unauthenticated attackers to exhaust server resources by supplying crafted property path strings that the MappingContext resolves inefficiently. The flaw is reachable wherever applications expose property path parsing to untrusted input, and with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) it is trivially triggerable, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Technical ContextAI

Spring Data Commons is the core infrastructure module underpinning the Spring Data family (JPA, MongoDB, Redis, Cassandra, etc.) and provides the MappingContext abstraction used to resolve PropertyPath instances against persistent entity metadata. The vulnerability is a CWE-400 (Uncontrolled Resource Consumption) issue in the property path resolution routine: when an attacker-controlled string is passed to PropertyPath.from() or equivalent MappingContext lookups, the parser performs expensive backtracking or repeated metadata traversal that grows disproportionately with input length or structure, allowing a small request to consume large amounts of CPU and memory. Because Spring Data repositories frequently accept property names from query parameters, sort fields, projections, and dynamic query derivation, the resolution path is often exposed to HTTP-facing input without obvious indication to developers.

RemediationAI

Upgrade Spring Data Commons to a fixed release per the vendor advisory at https://spring.io/security/cve-2026-41695 - based on the affected ranges, patched versions are expected in the 4.0.6, 3.5.12, and 3.4.15 lines or later, and applications should pull the fix transitively by upgrading the matching Spring Data module (e.g., Spring Data JPA) rather than pinning spring-data-commons directly to avoid version skew. Until upgrade is possible, restrict where attacker-controlled strings reach property path resolution: disable or front Spring Data REST endpoints with an allowlist of exposed properties, validate sort and filter parameters against a fixed schema before passing them to repositories, and cap request body size and request rate at the gateway to blunt amplification; the trade-off is reduced flexibility for legitimate dynamic queries and additional validation code at every controller boundary.