Loading vulnerability…
Denial of Service in Spring Data Commons Sort Parameter Parsing
CVE-2026-41711 is a denial-of-service vulnerability in Spring Data Commons in which crafted Sort parameters can cause recursive parsing to exhaust the stack and trigger a StackOverflowException. Exposure depends on application code or a consuming Spring Data module passing untrusted input to the affected API; Spring Data Commons does not directly expose that API to untrusted callers. Affected versions include 4.0.0–4.0.5, 3.5.0–3.5.11, 3.4.0–3.4.14, 3.3.0–3.3.16, 3.2.0–3.2.15, 3.1.0–3.1.14, 3.0.0–3.0.15, and 2.7.0–2.7.19. Older unsupported versions are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust the parsing thread's stack, causing a StackOverflowException and denial of service in the affected application. The vulnerability is rated Medium, with a CVSS v3.1 score of 5.9 and vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Sanitize untrusted input intended for sorting before passing it to Spring Data Commons. Review request-handling paths that accept Sort parameters, including relevant endpoints using @ProjectedPayload or @QuerydslPredicate, and prevent unsanitized attacker-controlled input from reaching the affected API.
Patch, then assume compromise.
Upgrade Spring Data Commons to a fixed release appropriate for the application's dependency line: 4.0.6 or 3.5.12, or enterprise-supported releases 3.4.15, 3.3.17, or 2.7.20. Fixed versions for the 3.0.x, 3.1.x, and 3.2.x lines are not specified; migrate those deployments and older unsupported versions to a supported, patched release. For bundled deployments, apply the relevant vendor security release, including Scheduler for VMware Tanzu Platform 2.0.26 or VMware Tanzu Data Flow on Kubernetes 2.1.4, where applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.