CVE-2026-41716

Name of the Vulnerable Software and Affected Versions Spring Data Commons versions 2.7.0 through 2.7.19 Spring Data Commons versions 3.3.0 through 3.3.16 Spring Data Commons versions 3.4.0 through 3.4.14 Spring Data Commons versions 3.5.0 through 3.5.11 Spring Data Commons versions 4.0.0 through 4.0.5

Description The internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys. This behavior allows for heap exhaustion—a condition where the application consumes all available memory in the heap area—through repeated requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.