org.springframework.data:spring-cql (1.5.2.release), org.springframework.data:spring-data-cassandra (1.5.2.release) +14 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.5.2.release -...

in.clouthink.daas:daas-bm-core (>=1.0.0, <=1.0.3), in.clouthink.daas:daas-bm-mongodb (>=1.0.0, <=1.0.3) +28 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - in.clouthink.daas:daas-bm-core =1.0.0, =1.0.0, =3.0.1, =1.0.0,...

ch.sharedvd.tipi:tipi-engine (>=1.0.5, <=1.1.9), cn.easyproject:easyshiro-redis-cache (2.6.0-release) +184 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.9.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ch.sharedvd.tipi:tipi-engine =1.0.5, =1.0.0-release,...

at.researchstudio.sat:won-core (>=0.4, <=0.9), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +88 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.16.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.researchstudio.sat:won-core =0.4, =0.4, =0.4, =0.4, =0.4,...

com.highway2urhell:h2hell-web (>=1.0.1, <=1.0.5), io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.beta6, <=1.1.0.cr1) +24 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.highway2urhell:h2hell-web =1.0.1, =1.1.0.beta6, =1.1.0.beta...

Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

com.aol.microservices:microserver-boot (>=0.53.1, <=0.59), com.aol.microservices:microserver-core (>=0.5, <=0.59) +88 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.9.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:microserver-boot =0.53.1, =0.5,...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.3.0.rc1, <=1.3.0.release), com.arcadeanalytics:arcadeanalytics (>=1.0.2, <=1.0.8) +48 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.14.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

com.github.micromix:micromix-compendium-crud (0.4), com.shigengyu:hyperion (0.0.1) +38 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.6.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.micromix:micromix-compendium-crud 0.4 -...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2325 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41716 Source advisory: GHSA-9FW2-H3HF-293R...

org.dataone:d1_cn_common (2.3.0), org.sentilo.agent:sentilo-agent-activity-monitor (1.7.0) +10 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.6.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.dataone:d1cncommon 2.3.0 -...

com.github.akiraly.reusable-poms:pom-parent-with-spring-hibernate-querydsl (3), com.github.akiraly.reusable-poms:pom-parent-with-spring-hibernate-querydsl-core (3) +41 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.6.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: -...

co.aurasphere.botmill:botmill-core (>=1.0.0, <=1.0.2), co.aurasphere.botmill:fb-botmill (>=2.0.0-rc1, <=2.0.0-rc3) +30 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.5.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - co.aurasphere.botmill:botmill-core =1.0.0, =2.0.0-rc1, =1.1,...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +110 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.12.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =1.0.1, =3.0.1.3...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4), org.dspace:dspace-spring-rest (7.0-preview-1) +30 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.12.7.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: -...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.112.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +3269 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-commons MAVEN version =3.3.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41716 Source advisory: OSV:GHSA-9FW2-H3HF-293R...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.2.2.release, <=1.3.5.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +76 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.17.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

am.ik.blog:blog-mapper (>=4.4.1, <=4.5.0), cn.ibaijia:jsm-frame (1.3.24) +414 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.7.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.blog:blog-mapper =4.4.1, =1.0.0, =1.0.10, =6.6.667,...

at.researchstudio.sat:won-core (>=0.2, <=0.3), at.researchstudio.sat:won-cryptography (0.3) +175 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.researchstudio.sat:won-core =0.2, =0.2, =0.2, =0.2, =0.2,...

com.ganshane.lichen:lichen-activiti (>=0.5.9, <=0.5.10.2), com.ganshane.lichen:lichen-creeper (>=0.5.9, <=0.5.10.2) +63 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ganshane.lichen:lichen-activiti =0.5.9, =0.5.9, =0.5.9,...