Loading vulnerability…
Heap Exhaustion in Spring Data Commons Property-Lookup Cache
CVE-2026-41716 is a denial-of-service vulnerability in Spring Data Commons caused by an unbounded internal property-lookup cache that permanently retains attacker-controlled property-name strings, including negative lookup results. Applications that forward unfiltered HTTP-supplied property names to PropertyPath.from allow repeated requests containing unique names to grow the cache until JVM heap memory is exhausted. Exposed processing paths include QuerydslPredicateArgumentResolver with default permit-all property visibility and @ProjectedPayload form-parameter binding through MapDataBinder. Affected versions are 2.7.0–2.7.19, 3.3.0–3.3.16, 3.4.0–3.4.14, 3.5.0–3.5.11, and 4.0.0–4.0.5; unsupported versions are also affected. Spring Data store modules can inherit the vulnerable dependency.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can exhaust application heap memory, causing severe service degradation or denial of service in the affected JVM. The vulnerability has high availability impact, with no identified direct confidentiality or integrity impact. Its CVSS v3.1 base score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
If you can’t patch tonight, do this now.
As a compensating control, reject property names outside a finite allowlist before invoking PropertyPath.from or affected binding mechanisms. Replace default permit-all Querydsl property visibility with explicit allowed bindings, and disable or restrict affected web-binding functionality where unnecessary. Restricting endpoint access and rate-limiting requests can reduce exposure but does not eliminate cumulative growth in a cache that retains keys indefinitely. No specific vendor workaround is identified.
Patch, then assume compromise.
Upgrade Spring Data Commons to the fixed release for the applicable branch: 2.7.20, 3.3.17, 3.4.15, 3.5.12, or 4.0.6, or a subsequent fixed release. Versions 2.7.20, 3.3.17, and 3.4.15 are commercial fixes; 3.5.12 and 4.0.6 are OSS fixes. Migrate unsupported branches to a supported, patched release. Update dependent Spring Data modules and packaged applications so their resolved dependencies actually include the corrected Commons version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.