CVE-2026-41716: Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names
Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.
Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate heap exhaustion by limiting/controlling requests that can trigger Spring Data web support property lookups (e.g., rate limit or throttle endpoints that accept attacker-supplied property names).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41716?
CVE-2026-41716 has a severity rating of 7.5, indicating a high risk.
How do I fix CVE-2026-41716?
To fix CVE-2026-41716, upgrade to a patched version of Spring Data Commons that is not affected by this vulnerability.
What are the affected versions of CVE-2026-41716?
CVE-2026-41716 affects Spring Data Commons versions from 2.7.0 to 2.7.19 and 3.3.0 to 3.3.16, among others.
What is the impact of CVE-2026-41716?
CVE-2026-41716 can lead to heap exhaustion through unbounded negative-result caching based on attacker-supplied property names.
Is CVE-2026-41716 a remote vulnerability?
Yes, CVE-2026-41716 is a remote vulnerability, allowing exploitation without prior authentication.