GHSA-9FW2-H3HF-293R Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

EUVD-2026-35892

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

GHSA-HC43-M36C-8V33 Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

EUVD-2026-35899

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

org.springframework.data:spring-data-mongodb-cross-store (2.0.0.release), org.tmurakam:spring-session-ext-mongo (1.5.0) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.github.eagle6688:devutility.external (>=1.0, <=1.0.4), org.springframework.data:spring-data-mongodb-cross-store (2.0.4.release) +2 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.eagle6688:devutility.external =1.0, =2.0.1.release,...

bd.ac.seu.erp:model (>=0.0.1, <=0.0.2), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (>=0.1.0-rc3, <=0.1.0-rc4) +24 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - bd.ac.seu.erp:model =0.0.1, =0.1.0-rc3, =0.14, =3.0.16, =3.0.16...

com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (0.1.0-rc5), com.github.eagle6688:devutility.external.mongo (2.0.6.5) +35 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-mongodb-conf (>=3.0.0.release, <=3.0.1.release), com.github.paulcwarren:content-mongo-spring-boot-starter (>=0.3.0, <=0.4.0) +18 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (0.1.0-rc6), com.github.cloudyrock.mongock:mongock-spring (>=2.0.0-beta, <=3.1.0.beta) +22 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.github.softbasic:micro-core (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-mongodb (2.0.7.release) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.softbasic:micro-core =0.0.1, =2.0.4.release,...

com.antelopesystem.crudframework:crud-framework-mongo-connector (>=0.1.0, <=0.5.0), com.antelopesystem.crudframework:crud-framework-utils (>=0.1.1, <=0.5.0) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antelopesystem.crudframework:crud-framework-mongo-connecto...

org.smarti18n:smarti18n-messages (>=1.0.0, <=1.0-pre7), org.springdoc:springdoc-openapi-test-app3 (3.1.1) +5 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.smarti18n:smarti18n-messages =1.0.0, =5.0.13.release,...

com.bol:spring-data-mongodb-encrypt (>=2.0.0, <=2.3), com.github.apavlidi:restfulqueries (0.0.1) +5 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.bol:spring-data-mongodb-encrypt =2.0.0, =2.0.6.6, =1.0.2,...

com.github.aidensuen:mongodao-core (>=1.0.1, <=1.1.2), com.github.aidensuen:mongodao-pagehelper (>=1.0.3, <=1.1.2) +30 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.aidensuen:mongodao-core =1.0.1, =1.0.3, =1.0.3,...

ch.sahits.game:openpatriciantest (>=1.0.0, <=1.0.1), com.alipay.sofa:sofa-tracer-mongodb-plugin (>=3.1.0, <=3.1.2) +22 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - ch.sahits.game:openpatriciantest =1.0.0, =3.1.0, =2.1.0.release...

io.eventuate.tram.view.support:eventuate-tram-view-support-e2e-tests (>=0.3.0.release, <=0.5.0.release), io.github.daggerok:distributed-lock-mongodb (2.1.1) +30 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

org.springframework.boot:spring-boot-starter-data-mongodb (1.5.15.release), org.springframework.data:spring-data-mongodb-cross-store (1.10.14.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...