GHSA-5M4M-73W9-8433 Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: GHSA-GG69-9WWP-6JX2...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: OSV:GHSA-GG69-9WWP-6JX2...

org.springframework.data:spring-data-rest-hal-browser (2.4.6.release), org.springframework.data:spring-data-rest-webmvc (2.4.6.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

com.groupbyinc:common-spring-boot (>=79, <=92), com.heapbrain:heapaudit (1.0.0) +6 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.groupbyinc:common-spring-boot =79, =1.0.1, =1.0.1,...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.zhycn:xbird-starter-swagger2 (>=1.0.0, <=1.3.0), com.heapbrain:testdeed (>=1.2.6, <=1.3.2) +11 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.9.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.zhycn:xbird-starter-swagger2 =1.0.0, =1.2.6,...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-RG79-863Chttps://vulners.com/g...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41837 Source advisory: OSV:GHSA-MWPV-RG79-863Chttps://vulners.c...

org.springframework.boot:spring-boot-starter-data-rest (1.5.18.release), org.springframework.data:spring-data-rest-hal-browser (2.6.17.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.17.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.dspace:dspace-spring-rest (7.0-preview-1), org.springframework.boot:spring-boot-starter-data-rest (1.4.4.release) +2 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.7.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.dspace:dspace-spring-rest 7.0-preview-1 -...

org.jsondoc:jsondoc-springmvc (>=1.2.14, <=1.2.23), org.springframework.data:spring-data-rest-hal-browser (2.5.1.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.jsondoc:jsondoc-springmvc =1.2.14, =1.2.23 -...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-...

io.fabric8:process-spring-boot-itests-service-invoicing (>=1.2.0.beta2, <=1.2.0.beta3), org.springframework.boot:spring-boot-starter-data-rest (1.1.5.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.1.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-service-invoicing...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.springframework.boot:spring-boot-starter-data-rest (>=1.2.7.release, <=1.2.8.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.2.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.netflix.spectator:spectator-web-spring =0.41.0,...

org.springframework.boot:spring-boot-starter-data-rest (1.5.17.release), org.springframework.data:spring-data-rest-hal-browser (2.6.16.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.16.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.data:spring-data-rest-webmvc (2.0.0.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

org.springframework.data:spring-data-rest-hal-browser (2.5.9.release), org.springframework.data:spring-data-rest-webmvc (2.5.9.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.9.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

io.fabric8.jube.images.fabric8:springboot-webmvc (>=2.0.38, <=2.2.5), org.lightadmin:lightadmin (1.2.0.rc1) +4 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.2.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8.jube.images.fabric8:springboot-webmvc =2.0.38,...