Spring patches LDAP auth bypass and multiple DoS flaws across Framework and Data

Spring disclosed a broad set of vulnerabilities across Spring Framework, Spring Data Commons, and Spring LDAP, including a high-severity authentication bypass tracked as CVE-2026-41720. The LDAP flaw allows login with a valid username and an empty or null password when the backing LDAP server permits unauthenticated binds, affecting authentication flows that use AbstractContextSource, LdapTemplate, or LdapClient. Spring also fixed a low-severity WebFlux session fixation issue (CVE-2026-41839) tied to compromised subdomains, and an information disclosure bug (CVE-2026-41841) in Spring MVC and WebFlux where shared static-resource caches could expose protected files if a public resource with the same name had already been cached.

Several denial-of-service issues were patched at the same time. In Spring Framework, CVE-2026-41840 can leak memory through malicious multipart requests in WebFlux, while CVE-2026-41842 can tie up HTTP connections through slow resolution of versioned file-system resources in Spring MVC or WebFlux. In Spring Data Commons, CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, and CVE-2026-41721 can be triggered by attacker-controlled property paths, sort parameters, property names, or @ProjectedPayload data binding, leading to stack overflows, heap exhaustion, or excessive memory allocation when applications expose those inputs to untrusted users. Spring urged customers to upgrade to fixed releases, including Framework 7.0.8, 6.2.19, and 6.1.28, Data Commons 4.0.6 and 3.5.12, and LDAP 2.4.5, 3.2.18, 3.3.8, or 4.0.4, with some older branches receiving fixes only through commercial support.