CVE-2026-41695

What it actually does

This vulnerability allows an unauthenticated remote attacker to trigger excessive CPU, memory, or stack consumption in Spring Data Commons when attacker-controlled property path strings are passed into MappingContext property path resolution. Applications that expose sorting, filtering, querying, binding, projection, or search features that ultimately resolve user-supplied property paths may repeatedly parse or traverse complex path expressions until application resources are exhausted, causing degraded performance or service failure. The flaw affects Spring Data Commons 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, and 3.4.0 through 3.4.14.

Why it matters to the business

Successful exploitation can make affected Java applications slow, unstable, or unavailable without requiring authentication or user interaction. This can interrupt customer-facing services, APIs, internal workflows, batch jobs, and dependent applications that rely on Spring Data-backed services. Although there is no known KEV listing, ransomware association, or public exploit maturity reported, the flaw is network-accessible, low-complexity, and can cause high availability impact, so internet-facing applications and high-traffic APIs should be prioritized.

How an attack unfolds

An attacker first identifies an application endpoint that accepts user-controlled field names, sort keys, filter expressions, query properties, projection paths, or similar path-like input. The attacker then sends crafted property path strings designed to force Spring Data Commons MappingContext property path resolution into expensive processing. Because exploitation does not require authentication, user interaction, or special privileges, repeated requests can be sent directly over the network. If the application passes those strings into vulnerable Spring Data Commons versions, the parsing and resolution logic may consume excessive CPU, heap, stack, or garbage-collection capacity. At scale, this can produce request timeouts, thread pool exhaustion, JVM instability, container restarts, or full service outage.

How to fix it

Upgrade Spring Data Commons to a version newer than the affected ranges: 4.0.6 or later for the 4.0.x line, 3.5.12 or later for the 3.5.x line, or 3.4.15 or later for the 3.4.x line, if those releases are available from the vendor. If an exact fixed version is specified by the application platform, framework BOM, or vendor advisory, use that version or later. Rebuild and redeploy all applications that package the vulnerable dependency, including transitive dependencies brought in through Spring Data modules or Spring Boot dependency management. As defense in depth, do not pass raw user-supplied property path strings directly into Spring Data mapping or query resolution; enforce allow-lists of permitted fields, maximum length limits, maximum nesting depth, request body limits, request timeouts, rate limits, and circuit breakers. For internet-facing endpoints, consider WAF or API gateway rules that block excessively long or deeply nested field/path parameters while patching is underway.

How to confirm the fix worked

Confirm exposure by reviewing dependency manifests, SBOMs, build files, and runtime classpaths for Spring Data Commons versions 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, or 3.4.0 through 3.4.14. Use Maven, Gradle, container image scanning, or software composition analysis to verify the resolved version actually deployed, not only the declared version. After upgrading, confirm the packaged artifact contains a non-affected Spring Data Commons version and redeploy all instances. In staging, test endpoints that accept sort, filter, field, projection, or property path input with long and malformed values and verify they are rejected quickly by validation controls rather than reaching expensive MappingContext resolution. Monitor CPU, heap, GC, request latency, HTTP 5xx rates, and restart counts after deployment to confirm the mitigation is effective.

Typical attack path

1. Discover an application endpoint that accepts property names, nested object paths, sort fields, filter fields, or query parameter paths.
2. Submit unusually long, deeply nested, recursive-looking, or malformed property path strings to that endpoint.
3. Observe whether the application response slows, times out, or returns server errors.
4. Automate repeated requests to amplify CPU, memory, stack, garbage-collection, or thread-pool pressure.
5. Sustain traffic until the application becomes degraded, restarts, or becomes unavailable to legitimate users.

How to detect it

To determine whether this was already exploited, review HTTP access logs, API gateway logs, WAF logs, application logs, JVM logs, APM traces, container orchestration events, and infrastructure metrics. Look for bursts of requests to endpoints that accept sort, filter, field, query, search, projection, or property path parameters where values are unusually long, deeply nested, dot-separated, bracket-heavy, or repeatedly malformed. Correlate those requests with increased CPU usage, heap growth, garbage-collection pressure, thread pool saturation, request timeouts, HTTP 500/502/503/504 responses, pod or JVM restarts, OutOfMemoryError, StackOverflowError, or Spring Data property path resolution exceptions. Because this is a denial-of-service condition, evidence may appear primarily as performance degradation and crash artifacts rather than persistence, malware, or file-system changes. There are no known named threat actors, KEV exploitation, or ransomware campaigns associated with the provided intelligence, so detection should focus on behavior and resource-exhaustion patterns rather than actor-specific indicators.

• org.springframework.data.mapping.context.MappingContext
• org.springframework.data.mapping.PropertyPath
• PropertyReferenceException
• java.lang.OutOfMemoryError
• java.lang.StackOverflowError
• GC overhead limit exceeded
• OutOfMemoryError: Java heap space
• StackOverflowError
• HTTP 503
• HTTP 504
• sort=
• filter=
• fields=
• field=
• projection=
• property=
• path=
• query=

What your security team should do

• Inventory applications and services using Spring Data Commons, especially internet-facing APIs and services that accept dynamic sort, filter, search, projection, or property path parameters.
• Prioritize upgrades for applications running affected versions 4.0.0-4.0.5, 3.5.0-3.5.11, or 3.4.0-3.4.14.
• Add input validation that allow-lists permitted property names and rejects overly long, deeply nested, or malformed path strings before they reach Spring Data resolution logic.
• Deploy compensating controls such as API gateway request limits, WAF rules, rate limiting, request timeouts, and autoscaling safeguards while patching is in progress.
• Review application logs and observability data for historical spikes in CPU, heap usage, garbage collection, request latency, 5xx errors, and JVM restarts correlated with requests containing unusually long path-like parameters.
• Create detection content for repeated requests containing long dot-separated, bracketed, or nested property path values followed by application errors, timeouts, or resource exhaustion events.
• Ensure dependency management policies prevent reintroduction of affected Spring Data Commons versions through transitive dependencies or older framework BOMs.