CVE-2026-41721: Spring Data Commons Memory Exhaustion DoS Vulnerability

Technical summary

The vulnerability resides in Spring Data Commons' handling of projected payloads when Web Support is active. The @ProjectedPayload annotation is designed to map incoming request data to projection interfaces; however, the framework fails to properly constrain memory allocation during this mapping process. A specially crafted request can trigger uncontrolled memory consumption, leading to heap exhaustion and eventual JVM termination. This is classified as an Uncontrolled Resource Consumption issue (CWE-400). The attack vector is network-based, requires no authentication, but has high attack complexity due to configuration prerequisites. The CVSS 3.1 score of 5.9 reflects the availability impact with no confidentiality or integrity compromise.

Business impact

Impacted applications experience service disruption without data breach risk. For production environments relying on Spring Data Commons with Web Support and projection mapping, a successful attack results in downtime that affects customer-facing services, revenue-generating operations, and user experience. Organizations in real-time transaction processing, streaming, or high-availability use cases face compounded harm. The vulnerability does not enable data exfiltration, unauthorized access, or system compromise, limiting incident scope to availability restoration and investigation overhead.

Affected systems

Spring Data Commons versions across multiple release lines are vulnerable: the 4.x line (4.0.0–4.0.5), 3.x line (3.5.0–3.5.11, 3.4.0–3.4.14, 3.3.0–3.3.16, 3.2.0–3.2.15, 3.1.0–3.1.14, 3.0.0–3.0.15), and 2.7.x line (2.7.0–2.7.19). Spring Data Commons is a foundational component used by many Spring Data projects (JPA, MongoDB, REST, etc.) and appears in countless enterprise Java applications. However, exploitation requires both Web Support to be active and at least one controller method annotated with @ProjectedPayload, which narrows real-world exposure. Organizations should inventory applications using Spring Data Commons and confirm the presence of both conditions before escalating priority.

Exploitability

The vulnerability has a high attack complexity rating, meaning exploitation is not straightforward. An attacker must understand the target application's use of @ProjectedPayload, craft a request body that triggers pathological memory allocation behavior, and time or repeat the request to exhaust heap resources. No authentication is required, and the attack is entirely remote. The absence of CISA KEV listing and lack of public weaponized exploits suggest the vulnerability has not yet become a widespread attack vector, though the technical barrier to exploitation is not prohibitively high for determined threat actors. Organizations should assume exploitation is possible but not imminent across all environments.

Remediation

Upgrade Spring Data Commons to patched versions. Verify the vendor advisory from Broadcom/VMware for exact patched release numbers across all affected lines (2.7.x, 3.0.x through 3.5.x, and 4.0.x). As an interim control, disable Spring Data Web Support if projection mapping is not essential, or restrict @ProjectedPayload usage to trusted input sources only. Code review of controller methods using @ProjectedPayload and monitoring for unexpected memory spikes can provide additional defensive layers while patches are staged.

Patch guidance

1. Identify all internal applications and dependencies using Spring Data Commons. 2. Cross-reference against the affected version ranges provided in the CVE. 3. Consult the Broadcom Spring Data Commons security advisory for patched versions corresponding to each release line. 4. Prioritize patching of production systems first, particularly those exposed to untrusted input. 5. Test patched versions in a staging environment before production rollout, as memory allocation and data binding changes may affect performance baselines. 6. Verify that patches are applied across all transitive dependencies that pull in Spring Data Commons.

Detection guidance

Monitor application logs and JVM metrics for sudden memory pressure spikes, out-of-memory errors, or garbage collection pauses correlated with HTTP requests containing large or malformed request bodies directed at endpoints using @ProjectedPayload. Inspect network traffic for repeated requests with suspicious or oversized payloads to projection-mapped endpoints. Implement heap memory thresholds and alerting in your JVM monitoring stack. Review application startup logs to confirm whether Spring Data Web Support is enabled; if it is not, this vulnerability cannot be exploited. Security event correlation systems should flag repeated HTTP 500 or 503 responses from specific application endpoints as a potential indicator of attack activity.

Why prioritize this

Medium severity with availability impact in a widely-deployed framework justifies prompt attention but not emergency response. The requirement for specific configuration (Web Support + @ProjectedPayload) limits blast radius. The lack of KEV listing and public exploits suggests the vulnerability has not become an active threat in the wild. However, organizations operating multi-tenant platforms or high-volume transaction systems should prioritize patching sooner to reduce DoS risk. Patch this vulnerability within your standard 30-60 day update cycle, or accelerate if you have confirmed exposure and external-facing services using the affected configuration.

Risk score, explained

CVSS 5.9 (Medium) reflects the denial-of-service impact (availability) with no confidentiality or integrity risk. The high attack complexity (AC:H) due to configuration prerequisites and the requirement for attacker knowledge of the application's use of @ProjectedPayload prevent a higher score. The network attack vector and lack of authentication lower the barrier to attempt, but the combination of factors yields a moderate risk assessment. Context-specific factors—such as reliance on continuous availability, exposure of projection endpoints to untrusted networks, or critical business processes—may elevate effective risk within your organization.

Frequently asked questions