What is the CVSS score of CVE-2026-41711?

CVE-2026-41711 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-41711?

Yes, a patch is available for CVE-2026-41711. Update the affected software to the latest version immediately.

Spring Data Commons CVE-2026-41711

EUVD-2026-35897 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-10 security@vmware.com

GHSA-5vpf-xvv7-c8vh

Denial Of Service Java Spring Data Commons

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:41 vuln.today

DescriptionCVE.org

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

AnalysisAI

Denial of Service in Spring Data Commons affects applications that parse Sort parameters, triggering a StackOverflowException via crafted input. All major supported and legacy branches from 2.7.x through 4.0.x are affected, making the blast radius exceptionally broad across the Spring ecosystem. CVSS rates this Medium (5.9) with a high attack complexity qualifier (AC:H), unauthenticated network access (PR:N), and full availability impact (A:H); no active exploitation is confirmed and no public exploit code has been identified at time of analysis.

Technical ContextAI

Spring Data Commons is the foundational library underpinning all Spring Data modules (JPA, MongoDB, Redis, etc.), providing shared infrastructure including query abstraction, pagination, and Sort parameter handling used widely in Java-based data access layers. The vulnerability is rooted in CWE-400 (Uncontrolled Resource Consumption): the Sort parameter parser likely employs recursive descent or recursive object construction without a depth or complexity guard, allowing a specially crafted input string to exhaust the JVM thread stack and raise an uncaught StackOverflowException. Because Sort parameters are typically surfaced via HTTP query strings (e.g., ?sort=field,direction), any web-facing endpoint backed by Spring Data that accepts user-supplied sort input is potentially reachable. The issue spans eight distinct release lines (2.7.x, 3.0.x through 3.5.x, and 4.0.x), reflecting a long-standing architectural pattern rather than a narrow regression.

RemediationAI

Apply the vendor-released patch per the Spring security advisory at https://spring.io/security/cve-2026-41711; exact fixed versions per branch are not independently confirmed from the provided data and must be obtained directly from that advisory to avoid installing an incorrect target version. As a compensating control pending patching, applications can validate or sanitize Sort parameter input at the API gateway or controller layer before it reaches Spring Data's parser - reject inputs exceeding a defined length threshold or complexity limit (e.g., block Sort strings with more than a configurable number of fields or nested separators). Additionally, enabling HTTP request parameter size limits at the servlet container level (Tomcat maxParameterCount, Spring's HiddenHttpMethodFilter, etc.) can reduce the malformed payload surface. Note that input sanitization at the application layer may require code changes and regression testing, and container-level parameter limits may affect legitimate use cases with large sort payloads. Upgrading within the same minor branch is strongly preferred where operationally feasible.