Spring Data Commons DoS Vulnerability Advisory (CVE-2026-41711)

Vulnerability Overview CVE ID: CVE-2026-41711 Publication Date: June 9, 2026 Severity: Medium Description: Applications using Spring Data Commons may be susceptible to a Denial of Service (DoS) attack resulting in a when parsing the parameter. This issue occurs when an application explicitly exposes an endpoint that accepts parameters and fails to sanitize the input, or when endpoint parameters are annotated with or . Affected Products Affected Product: Spring Data Commons Affected Versions: - 4.0.0 to 4.0.5 - 3.5.0 to 3.5.11 - 3.4.0 to 3.4.14 - 3.3.0 to 3.3.16 - 3.2.0 to 3.2.15 - 3.1.0 to 3.1.14 - 3.0.0 to 3.0.15 - 2.7.0 to 2.7.19 - Other unsupported versions Remediation Recommendation: Users of affected versions should upgrade to the corresponding patched releases and ensure that any untrusted input used for sorting is appropriately sanitized after processing. Specific Patched Versions: - 4.0.x → 4.0.6 (OSS) - 3.5.x → 3.5.12 (OSS) - 3.4.x → 3.4.15 (Enterprise Support Only) - 3.3.x → 3.3.17 (Enterprise Support Only) - 2.7.x → 2.7.20 (Enterprise Support Only) References NVD CVSS v3 Calculator History 2026-06-09: Initial vulnerability report published. Report a Vulnerability To report a security vulnerability in Spring projects, please refer to the Security Policy. --- Note: No POC (Proof of Concept) or exploitation code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Spring Data Commons DoS Vulnerability Advisory (CVE-2026-41711)