CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2327 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41695 Source advisory: MEND:CVE-2026-41695...

CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

CVE-2026-41695

Spring Data Commons contains a Denial of Service risk (CVE-2026-41695) caused by resource exhaustion during property path resolution in MappingContext. Affected versions are Spring Data Commons 4.0.0–4.0.5; 3.5.0–3.5.11; 3.4.0–3.4.14. The provided documents describe the issue and affected release...

CVE-2026-41695

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.3.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...

org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.13.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...

gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release) +5 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.14.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.14.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin...

io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.17.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.12.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.3.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...

io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.17.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...

gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release) +5 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.14.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.14.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin...

org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.13.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...

cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +689 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.0.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41696 Source advisory:...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +127 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=5.0.0-m4, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0-m4, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41696 Source advisory:...

cve-2026-41729 - HIGH - Spring Data REST SpEL Injection via Map Key in JSON Patch

cve-2026-41729 - HIGH - Spring Data REST SpEL Injection via Map Key in JSON Patch...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the @Query regex parameter binding when a bound parameter is placed inside a regular expression literal using \Q...\E quoting e.g. @Query" name : /^\\Q?0\\E$/ "...