Skip to content
OpenAdvisories

Package · Maven

org.springframework.data:spring-data-commons

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.9
    CVE-2026-41721

    Spring Data Commons Denial of Service via Data Binding

    Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request th…

    Spring Spring Data Commons org.springframework.data:spring-data-commons Maven
  • High 7.5
    CVE-2026-41716

    Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

    Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 …

    Spring Spring Data Commons org.springframework.data:spring-data-commons Maven
  • Medium 5.9
    CVE-2026-41711

    Potential Denial of Service through crafted Sort Parameters

    Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.…

    Spring Spring Data Commons org.springframework.data:spring-data-commons Maven
  • High 7.5
    CVE-2026-41695

    Denial of Service in Spring Data Commons Property Path Resolution

    Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.…

    Spring Spring Data Commons org.springframework.data:spring-data-commons Maven
  • High 7.5
    CVE-2018-1259 Public exploit

    Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references

    Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying li…

    Pivotal Spring Data Commons org.springframework.data:spring-data-commons Maven
  • High 7.5
    CVE-2018-1274

    Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation

    Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests agains…

    Spring by Pivotal Spring Framework org.springframework.data:spring-data-commons Maven
  • Critical 9.8
    CVE-2018-1273 Exploited · Ransomware Public exploit EPSS 97%

    Spring Data Commons remote code injection vulnerability

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can sup…

    Spring by Pivotal Spring Framework org.springframework.data:spring-data-commons Maven
    KEV Mar 25, 2022