5.9Media
CVE-2026-41721Spring Data Commons Denial of Service via Data Binding
Descripción
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Debilidad (CWE):
CWE-400
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| broadcom | spring data commons | 2.7.0 – < 2.7.20 | |
| Spring | Spring Data Commons | 4.0.0 – < 4.0.5.1, 3.5.0 – < 3.5.11.1, 3.4.0 – < 3.4.15, 3.3.0 – < 3.3.17, 3.2.0 – < 3.2.16, 3.1.0 – < 3.1.15, 3.0.0 – < 3.0.16, 2.7.0 – < 2.7.20 |
Referencias y parches
- https://spring.io/security/cve-2026-41721 Vendor Advisory
Coincidencias CPE (NVD) (8)
cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 2.7.0 < 2.7.20cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 3.0.0 ≤ 3.0.15cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 3.1.0 ≤ 3.1.14cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 3.2.0 ≤ 3.2.15cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 3.3.0 < 3.3.17cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.15cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 3.5.0 < 3.5.11.1cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.5.1