Spring Data Commons CVE-2026-41711

Exploitation requires that the target application uses Spring Data Commons Sort parameter parsing AND exposes an HTTP endpoint that passes user-supplied input directly into that parsing logic (e.g., a pageable/sortable repository endpoint accepting a 'sort' query parameter). The CVSS AC:H rating indicates that achieving the StackOverflowException requires a specifically crafted payload - not any arbitrary sort string - limiting opportunistic exploitation. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any network-accessible endpoint meeting the above conditions is reachable by external attackers. Exploitation is limited by: (1) the AC:H complexity requirement indicating a non-trivial trigger condition, (2) the necessity of an exposed sort-accepting endpoint in the target application, and (3) impact confined to availability - no authentication bypass, data access, or code execution is possible through this vector.

The CVSS 5.9 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H captures a specific risk profile: network-reachable without authentication, but requiring elevated attack complexity to trigger, with impact limited entirely to availability. The AC:H designation is a meaningful limiting factor - exploitation is not a simple single-request trigger and likely requires knowledge of the exact payload structure needed to induce deep recursion in the parser. There is no confidentiality or integrity impact, so the worst-case outcome is application unavailability, not data exfiltration or code execution. No EPSS score was provided in the source data, so probability of exploitation cannot be quantified numerically. The absence of a CISA KEV entry and no reported POC reduces urgency relative to a comparably scored exploitable-in-the-wild issue. However, the extremely wide version range (spanning roughly 4 years of releases across 8 branches) and the ubiquity of Spring Data in enterprise Java applications mean aggregate exposure is high even if per-instance risk is moderate. Organizations running public-facing Spring-based REST APIs with user-controlled sort parameters should treat this as a meaningful patching priority.

An unauthenticated remote attacker identifies a publicly exposed REST endpoint of a Spring Data-backed application that accepts a user-controlled 'sort' query parameter. The attacker crafts a malformed Sort expression designed to trigger deep or unbounded recursion in Spring Data Commons's Sort parser, submits the request, and causes a StackOverflowException that crashes the application thread or the entire application context, resulting in a denial of service. No public exploit code has been identified at time of analysis, but the AC:H rating indicates exploitation requires a specific, non-trivial payload construction.