What is the CVSS score of CVE-2026-41721?

CVE-2026-41721 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-41721?

Yes, a patch is available for CVE-2026-41721. Update the affected software to the latest version immediately.

Spring Data Commons CVE-2026-41721

EUVD-2026-35902 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-10 security@vmware.com

GHSA-5m4m-73w9-8433

Denial Of Service Java Spring Data Commons

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:43 vuln.today

DescriptionCVE.org

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.

Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

AnalysisAI

Uncontrolled resource consumption in Spring Data Commons exposes applications to a remote Denial of Service condition when two specific features are active simultaneously. An unauthenticated remote attacker can send a specially crafted HTTP request to any endpoint backed by a @ProjectedPayload-annotated controller method, triggering unbounded memory allocation that exhausts the JVM heap and crashes the application. The vulnerability spans eight major release lines (2.7.x through 4.0.x), making the potential blast radius broad across Spring-based Java backends. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS attack complexity rating of High reflects non-trivial preconditions that meaningfully limit opportunistic exploitation.

Technical ContextAI

Spring Data Commons is the shared infrastructure library underpinning all Spring Data modules (JPA, MongoDB, Redis, etc.). The affected component is Spring Data Web Support, an optional Spring MVC integration layer that binds HTTP request bodies to domain objects using interface projections. The @ProjectedPayload annotation (org.springframework.data.web.ProjectedPayload) instructs the framework to map inbound request data through a JDK dynamic proxy that satisfies a projection interface. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the deserialization or binding path triggered during @ProjectedPayload processing fails to impose a ceiling on memory allocated when parsing adversarially structured input - likely involving deeply nested, highly repetitive, or exponentially expanding payload structures that cause the binding mechanism to generate excessive intermediate objects before any size guard fires. The vulnerability is Java-platform-specific, consistent with the 'Java' tag provided by the reporter (security@vmware.com, the Spring/Broadcom security team).

RemediationAI

The primary fix is to upgrade Spring Data Commons to a version beyond the affected ranges for the relevant release line; exact patched release numbers are not confirmed in the provided input data and should be obtained directly from the vendor advisory at https://spring.io/security/cve-2026-41721, which is the authoritative source from the reporting party (security@vmware.com). Spring Boot users should check the Spring Boot release notes for dependency version bumps that bundle the fix. As a compensating control where immediate upgrade is not feasible, disable Spring Data Web Support entirely if @ProjectedPayload endpoints are not operationally required - this eliminates the vulnerable code path with no impact on non-web-bound data layers. If @ProjectedPayload endpoints must remain active, place a reverse proxy or API gateway in front of the application configured to enforce request body size limits (e.g., nginx client_max_body_size or an AWS WAF size constraint rule); note this mitigates payload-size-based attacks but may not address all crafted-structure variants. Restricting access to @ProjectedPayload endpoints to authenticated internal clients via network policy or application-level auth guard also reduces the exploitable surface, though it does not eliminate the vulnerability.