CVE-2026-41695

Name of the Vulnerable Software and Affected Versions Spring Data Commons versions 4.0.0 through 4.0.5 Spring Data Commons versions 3.5.0 through 3.5.11 Spring Data Commons versions 3.4.0 through 3.4.14

Description Applications may be subject to denial of service through resource exhaustion. This occurs when attacker-controlled property path strings are passed to the MappingContext property path resolution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.