CVE-2026-41716: Spring Data Commons Heap Exhaustion Denial-of-Service

Technical summary

CVE-2026-41716 is a denial-of-service vulnerability affecting Spring Data Commons' internal property-lookup caching mechanism. The vulnerability stems from the cache accepting attacker-supplied strings as keys without sanitization or eviction logic. An unauthenticated remote attacker can repeatedly send requests with varying malicious payloads, causing the cache to grow unbounded and exhaust heap memory. The vulnerability maps to CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS 3.1 score of 7.5 (HIGH), reflecting network-based exploitability with low attack complexity and high impact to availability.

Business impact

Applications using vulnerable Spring Data Commons versions will be susceptible to remote denial-of-service attacks. An attacker can render affected services unavailable without credentials or complex prerequisites, disrupting business operations and user access. This is particularly impactful for SaaS platforms, REST APIs, and microservices architectures that expose Spring Data-backed endpoints. Recovery requires application restart, with no way to prevent further attacks until patching is completed. Multi-tenant environments are at elevated risk if any tenant-controlled input reaches the property-lookup cache.

Affected systems

Spring Data Commons versions 2.7.0–2.7.19, 3.3.0–3.3.16, 3.4.0–3.4.14, 3.5.0–3.5.11, and 4.0.0–4.0.5 are vulnerable. Any Java application directly depending on these versions of Spring Data Commons is at risk. This includes applications using Spring Data JPA, Spring Data MongoDB, Spring Data Redis, and other Spring Data modules that inherit the vulnerable base library. Check your dependency tree for transitive inclusions of vulnerable versions.

Exploitability

This vulnerability is trivially exploitable. No authentication is required, and the attack vector is network-based with low complexity—an attacker needs only to craft HTTP requests (or equivalent) that trigger property lookups with attacker-controlled keys. Exploitation does not require user interaction or special system configuration. The impact is immediate: resource exhaustion will degrade performance and eventually crash the service. No KEV data is currently available for this CVE, but the straightforward nature of the attack and high availability impact make it an attractive target.

Remediation

Upgrade Spring Data Commons to patched versions as soon as feasible. Verify the specific patched version from the vendor advisory, as multiple release lines require targeted updates. Additionally, implement network-level rate limiting or request filtering in front of exposed endpoints to reduce the surface area for resource exhaustion attacks. Monitor heap memory usage and implement alerting for abnormal growth patterns. Review application logs for unusual patterns of property-lookup requests that might indicate active exploitation attempts.

Patch guidance

Contact your Spring Data Commons vendor (Broadcom) and consult their official security advisory for the specific patched version applicable to your release line. Generally, patch versions will be released for each affected line (2.7.x, 3.3.x, 3.4.x, 3.5.x, and 4.0.x). Plan updates carefully if you are on an older maintenance line, as vendor support timelines may influence your patching window. Verify compatibility with your application and run regression tests before deploying to production. Consider staging the upgrade in a non-production environment first to confirm no application-specific issues arise.

Detection guidance

Monitor Java application heap memory consumption for sudden or sustained increases that correlate with incoming request volume. Log property-lookup operations if available through Spring Data debugging, and look for requests with unusual or repetitive property names that don't match your application's legitimate data model. Check application metrics for a spike in cache size or entries. Network intrusion detection can flag repeated requests with varying payloads to the same endpoint if baseline behavior is established. Heap dumps from crashed or memory-constrained instances should be analyzed for cache map size anomalies.

Why prioritize this

This vulnerability warrants high prioritization due to its simplicity of exploitation, lack of authentication requirements, and direct impact to service availability. With a CVSS score of 7.5 and network-accessible attack surface, any public-facing or internal-network-exposed Spring Data application is at significant risk. The combination of ease of exploitation and business impact makes this suitable for immediate remediation in most environments. Organizations should prioritize patching of internet-facing services and APIs first, followed by internal systems.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the network-based attack vector, low attack complexity, and high impact to availability. The absence of authentication requirements and user interaction further elevates risk. The vulnerability does not expose confidential data or allow privilege escalation, keeping the score below CRITICAL. However, the guaranteed denial of service and ease of triggering place this firmly in the HIGH severity category, justifying immediate remediation efforts.

Frequently asked questions