fr.zebasto.dailymotion:dailymotion-sdk-client (1.0.0), fr.zebasto:dailymotion-sdk-client (1.0.1) +38 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.6.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - fr.zebasto.dailymotion:dailymotion-sdk-client 1.0.0 -...

EUVD-2026-35899

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.2.2.release, <=1.3.5.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +76 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.17.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

com.arpit9mittal.fmk:common-application-framework-core (>=1.0.0-rc1, <=1.0.0-rc2), com.arpit9mittal.fmk:common-application-framework-parent (>=1.0.0-rc1, <=1.0.0-rc2) +162 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.11.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.arpit9mittal.fmk:common-application-framework-core...

GHSA-9FW2-H3HF-293R Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

com.ganshane.lichen:lichen-activiti (>=0.5.9, <=0.5.10.2), com.ganshane.lichen:lichen-creeper (>=0.5.9, <=0.5.10.2) +63 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ganshane.lichen:lichen-activiti =0.5.9, =0.5.9, =0.5.9,...

com.github.ydespreaux.spring.data:spring-data-jpa-criteria (1.0.1), com.wueasy:wueasy-base-web (>=1.2.0, <=1.3.3) +68 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.18.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.ydespreaux.spring.data:spring-data-jpa-criteria...

com.sangupta:jerry-services (1.0.0), com.soterianetworks:spase-audit-es (>=0.9.45, <=0.9.59) +20 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.10.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.sangupta:jerry-services 1.0.0 -...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +368 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0.2, =1.0.2, =a.1.0.0,...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39), cn.jiangzeyin:common-redis (>=1.0.0, <=1.0.3) +57 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.12.11.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.jiangzeyin.fast-boot:common-redis =1.0.3, =1.0.0, =0.0.1,...

am.ik.blog:blog-mapper (>=4.4.1, <=4.5.0), cn.ibaijia:jsm-frame (1.3.24) +414 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.7.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.blog:blog-mapper =4.4.1, =1.0.0, =1.0.10, =6.6.667,...

com.github.acierto:aciertoteam-common (1.1.0), com.github.acierto:aciertoteam-geo (1.1.0) +36 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.10.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.acierto:aciertoteam-common 1.1.0 -...

at.molindo:spring-data-custom (0.1.0), com.aol.microservices:micro-dbcp (>=0.90, <=0.91.11) +213 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.12.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.molindo:spring-data-custom 0.1.0 -...

am.ik.blog:blog-mapper (>=4.0.0, <=4.4.0), am.ik.home:uaa-client (1.9.0) +316 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.blog:blog-mapper =4.0.0, =1.0.2.release, =1.2.0-alpha3,...

com.github.relai.vertx.springdata:mod-spring-data (0.5), io.fabric8:process-spring-boot-data (>=1.2.0.beta2, <=1.2.0.beta3) +23 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.relai.vertx.springdata:mod-spring-data 0.5 -...

com.github.iaunzu:strqlbuilder (>=1.1.0, <=1.1.1), com.github.osvaldopina:linkbuilder (>=0.1.1, <=0.3.0) +58 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.9.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.iaunzu:strqlbuilder =1.1.0, =0.1.1, =1.0.5, =0.8.5,...

com.github.jknack:mwa-mongo (0.4.0), com.github.jknack:mwa-morphia (0.4.0) +14 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.5.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.jknack:mwa-mongo 0.4.0 - com.github.jknack:mwa-morph...