CVE-2026-41721

Name of the Vulnerable Software and Affected Versions Spring Data Commons versions 4.0.0 through 4.0.5 Spring Data Commons versions 3.5.0 through 3.5.11 Spring Data Commons versions 3.4.0 through 3.4.14 Spring Data Commons versions 3.3.0 through 3.3.16 Spring Data Commons versions 3.2.0 through 3.2.15 Spring Data Commons versions 3.1.0 through 3.1.14 Spring Data Commons versions 3.0.0 through 3.0.15 Spring Data Commons versions 2.7.0 through 2.7.19

Description An issue exists where a specially crafted HTTP request can cause an application to allocate excessive memory, leading to a Denial of Service (DoS) condition. This occurs when Spring Data Web Support is enabled and a Controller method utilizes the @ProjectedPayload annotation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.