Loading vulnerability…
Spring Data Commons Projection Binding Memory Exhaustion DoS
CVE-2026-41721 is a denial-of-service vulnerability in Spring Data Commons projection binding. When Spring Data Web Support is enabled and a controller method uses @ProjectedPayload, a specially crafted HTTP request can trigger excessive memory allocation and disrupt application availability. Affected versions include 4.0.0–4.0.5, 3.5.0–3.5.11, 3.4.0–3.4.14, 3.3.0–3.3.16, 3.2.0–3.2.15, 3.1.0–3.1.14, 3.0.0–3.0.15, 2.7.0–2.7.19, and older unsupported releases.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote exploitation can exhaust application memory and cause denial of service, with high availability impact. No confidentiality or integrity impact is identified. The vulnerability is rated Medium, with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
If you can’t patch tonight, do this now.
If patching is delayed, disable Spring Data Web Support where feasible or avoid controller methods using @ProjectedPayload, removing the vulnerable request-processing configuration until a fixed release is deployed.
Patch, then assume compromise.
Upgrade Spring Data Commons to a fixed release: 4.0.6 or 3.5.12, or a subsequent supported release. Enterprise Support fixes are identified as 3.4.15, 3.3.17, and 2.7.20. For other affected branches, obtain the applicable vendor-supported fix or migrate to a supported fixed release. Applicable bundled-product fixes include Scheduler for VMware Tanzu Platform 2.0.26 and VMware Tanzu Data Flow on Kubernetes 2.1.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.