GHSA-88FW-V6X4-3F58 Spring Data: Unbounded property-path cache keyed by externally-supplied path string

🗓️ 31 Jul 2026 16:44:15Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Unbounded caching of unresolvable property paths leads to memory exhaustion under crafted requests.

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-data-commons jar	27 Jul 202607:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons [CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 ]	27 Jul 202620:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	10 Jul 202603:58	–	ibm
Circl	CVE-2026-41695	10 Jun 202605:00	–	circl
CNNVD	VMware Spring Data Commons 资源管理错误漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41695	9 Jun 202623:47	–	cve
Cvelist	CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution	9 Jun 202623:47	–	cvelist
EUVD	EUVD-2026-35891	31 Jul 202616:44	–	euvd
Github Security Blog	Spring Data: Unbounded property-path cache keyed by externally-supplied path string	31 Jul 202616:44	–	github

Source	Link
github	www.github.com/spring-projects/security-advisories/security/advisories/GHSA-88fw-v6x4-3f58
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41695
github	www.github.com/spring-projects/spring-data-commons/commit/96e9475b963218bb702959524187342671f6b080
github	www.github.com/spring-projects/spring-data-commons/commit/a4f893b66c18c70f2b22f29a2b55097b73c89941
github	www.github.com/spring-projects/security-advisories
github	www.github.com/spring-projects/spring-data-commons/releases/tag/3.5.12
github	www.github.com/spring-projects/spring-data-commons/releases/tag/4.0.6
spring	www.spring.io/security/cve-2026-41695

31 Jul 2026 17:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.00363

persistent property path unbounded caching invalid property path memory exhaustion spring data rest external path string dot path inputs