Loading vulnerability…
Denial of Service in Spring Data Commons Property Path Resolution
CVE-2026-41695 is a resource-exhaustion vulnerability in Spring Data Commons MappingContext property path resolution. Applications can be affected when attacker-controlled property path strings reach the resolver through application code or a consuming Spring Data module. Recursive or deeply nested domain property graphs, or submission of many unique invalid property paths, can enable excessive resource consumption and denial of service. Spring Data Commons does not directly expose the affected API to untrusted callers; exposure depends on the integrating application or module. Affected versions are 4.0.0–4.0.5, 3.5.0–3.5.11, and 3.4.0–3.4.14.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust application resources, degrading service responsiveness or making the affected application unavailable. The vulnerability is rated High with CVSS v3.1 score 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted property path strings from reaching MappingContext resolution. Apply strict validation and allowlisting to exposed path-bearing inputs, and rate-limit requests to reduce abuse involving large numbers of distinct paths. These controls do not replace upgrading. Spring states that no additional mitigation steps are necessary after applying the fix.
Patch, then assume compromise.
Upgrade Spring Data Commons to 4.0.6, 3.5.12, or 3.4.15, or a subsequent fixed release in the corresponding branch. Version 3.4.15 is available under Enterprise Support; deployments without access should migrate to a supported fixed branch. Update the dependency through the consuming application's supported dependency-management mechanism and verify the deployed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.