← Back

CVE-2026-41721

nvd nist
Published: Jun 10, 2026Modified: Jul 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.2 / Impact: 3.6
Source: security@vmware.com (Secondary)

Description

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Affected (8)

Broadcom
1 product
Spring Data Commons
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Broadcom
Spring Data Commons
From 2.7.0 to 2.7.20
Spring Data Commons
From 3.0.0 to 3.0.15
Spring Data Commons
From 3.1.0 to 3.1.14
Spring Data Commons
From 3.2.0 to 3.2.15
Spring Data Commons
From 3.3.0 to 3.3.17
Spring Data Commons
From 3.4.0 to 3.4.15
Spring Data Commons
From 3.5.0 to 3.5.11.1
Spring Data Commons
From 4.0.0 to 4.0.5.1

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.