CVE-2026-41711 vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons [CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 ]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 . Spring Data Commons is used in our microservices. These vulnerabilities have been addressed. Please read the details for remediatio...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-data-commons jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41695, CVE-2026-41711, CVE-2026-41716 and CVE-2026-41721 reported for spring-data-commons-3.4.11.jar, spring-data-commons-3.5.11.jar. Vulnerability Details CVEID:CVE-2026-41695 DESCRIPTION: Spring Data Commons...

CVE-2026-41711

A flaw was found in Spring Data Commons. Applications using this component may be vulnerable to a Denial of Service DoS attack. A remote attacker could exploit this by sending specially crafted Sort parameters, leading to a StackOverflowException and causing the application to become unavailable...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9187 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41711 Source advisory:...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0), ai.intelliswarm:swarmai-core (>=1.0.0, <=1.0.29) +3360 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-commons MAVEN version =3.4.0, =0.114.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =3.3.0, =0.5.8, =0.0.1, =0.0.1, =0.0.2 - be.jidoka:jdk-keycloak-admin 2.5.0 and more Source cves: CVE-2026-41711 Source advisory:...

cn.hankchan:utils (1.0.0), cn.net.vidyo:jsmth-data (3.3.120.release) +86 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.hankchan:utils 1.0.0 - cn.net.vidyo:jsmth-data...

co.aurasphere.botmill:botmill-core (>=1.0.0, <=1.0.2), co.aurasphere.botmill:fb-botmill (>=2.0.0-rc1, <=2.0.0-rc3) +30 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.5.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - co.aurasphere.botmill:botmill-core =1.0.0, =2.0.0-rc1, =1.1,...

com.github.darrachequesne:spring-data-jpa-datatables (>=1.0, <=2.6), com.github.lodsve:lodsve-mongodb (>=2.4.8, <=2.5.10) +61 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.10.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.darrachequesne:spring-data-jpa-datatables =1.0,...

org.springframework.data:spring-cql (1.5.21.release), org.springframework.data:spring-data-cassandra (1.5.21.release) +14 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.21.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.5.21.release -...

cn.yueshutong:spring-boot-starter-current-limiting (>=0.0.7.release, <=0.0.8.release), com.4dconcept.springframework.data:spring-data-marklogic (1.2.1.release) +137 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.12.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.yueshutong:spring-boot-starter-current-limiting...

com.github.relai.vertx.springdata:mod-spring-data (0.5), io.fabric8:process-spring-boot-data (>=1.2.0.beta2, <=1.2.0.beta3) +23 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.relai.vertx.springdata:mod-spring-data 0.5 -...

com.thinkbiganalytics.kylo.plugins:kylo-hadoop-authorization-ranger (>=0.8.3, <=0.9.1), com.thinkbiganalytics.kylo.plugins:kylo-ranger-rest-client (>=0.8.3, <=0.9.1) +33 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +3946 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.5.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

at.molindo:spring-data-custom (>=0.0.1, <=0.0.2), au.com.mountain-pass:hyperstate (>=1, <=3) +84 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.11.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.molindo:spring-data-custom =0.0.1, =1, =1.4, =1.4, =0.0.7,...

at.molindo:spring-data-custom (1.0.0), cn.patterncat:job-event-store-elasticsearch (0.0.2) +42 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.10.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.molindo:spring-data-custom 1.0.0 -...

com.epam.reportportal:commons-bugtracking (2.7.0), com.epam.reportportal:commons-dao (>=2.7.0, <=2.7.1.1) +250 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.epam.reportportal:commons-bugtracking 2.7.0 -...

com.github.acierto:aciertoteam-common (1.1.0), com.github.acierto:aciertoteam-geo (1.1.0) +36 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.10.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.acierto:aciertoteam-common 1.1.0 -...

com.ganshane.lichen:lichen-activiti (>=0.5.9, <=0.5.10.2), com.ganshane.lichen:lichen-creeper (>=0.5.9, <=0.5.10.2) +63 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ganshane.lichen:lichen-activiti =0.5.9, =0.5.9, =0.5.9,...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.112.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +6067 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.3.13)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41711 Source advisory: GHSA-5VPF-XVV7-C8VH...