Denial Of Service (DoS)

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to attacker-supplied strings being permanently retained as internal property-lookup cache keys, allowing repeated requests to exhaust application heap memory...

K000162894: Spring Data Relational vulnerability CVE-2026-41697

Security Advisory Description Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference...

CLSA-2026-1786547094 TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CLSA-2026-1786536841 TuxCare security update for org.springframework.data (3 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CLSA-2026-1782089830 TuxCare security update for org.springframework.data:spring-data-redis (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-redis to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1781830582 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1782089825 TuxCare security update for org.springframework.data:spring-data-jpa (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-jpa to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1782089808 TuxCare security update for org.springframework.data:spring-data-keyvalue (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1781830552 TuxCare security update for org.springframework.data:spring-data-r2dbc (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 1 CVE. Fixed in 1.5.18-tuxcare.2...

CLSA-2026-1781657701 TuxCare security update for org.springframework.data (1 CVE)

TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 3.7.18-tuxcare.2...

CLSA-2026-1781484835 TuxCare security update for org.springframework.data:spring-data-ldap (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2025-1754872136 TuxCare security update for org.springframework.data:spring-data-r2dbc (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 2 CVEs. Fixed in 1.5.18-tuxcare.1...

SpEL Expression Injection

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests. The vulnerability is due to the JSON Pointer path segment used as the map key being embedded directly into a SpEL expression without sanitization or validation, where...

Sensitive Information Exposure

Spring Data REST is vulnerable to Sensitive Information Exposure. The vulnerability is due to serialization of the full exception cause chain in HTTP error responses, allowing attackers to obtain persistence-layer implementation details and other internal application information through error...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +3955 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.5.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2326 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41695 Source advisory: GHSA-88FW-V6X4-3F58...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +3955 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.5.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2326 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41695 Source advisory: OSV:GHSA-88FW-V6X4-3F58...

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation Algorithmic DoS Impact When a consuming module routes user-supplied dot-paths sort parameters, projection paths, PATCH paths through...

GHSA-88FW-V6X4-3F58 Spring Data: Unbounded property-path cache keyed by externally-supplied path string

src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation Algorithmic DoS Impact When a consuming module routes user-supplied dot-paths sort parameters, projection paths, PATCH paths through...