← Back

CVE-2026-41716

nvd nist
Published: Jun 10, 2026Modified: Jul 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security@vmware.com (Secondary)

Description

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

Affected (5)

Broadcom
1 product
Spring Data Commons
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Broadcom
Spring Data Commons
From 2.7.0 to 2.7.20
Spring Data Commons
From 3.3.0 to 3.3.17
Spring Data Commons
From 3.4.0 to 3.4.15
Spring Data Commons
From 3.5.0 to 3.5.11.1
Spring Data Commons
From 4.0.0 to 4.0.5.1

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.