io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.beta6, <=1.1.0.cr1), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.beta6, <=1.1.0.cr1) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.beta...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.1.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

com.groupbyinc:common-spring-boot (>=79, <=92), com.heapbrain:heapaudit (1.0.0) +6 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.groupbyinc:common-spring-boot =79, =1.0.1, =1.0.1,...

org.dspace:dspace-spring-rest (7.0-preview-1), org.springframework.boot:spring-boot-starter-data-rest (1.4.4.release) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.7.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.dspace:dspace-spring-rest 7.0-preview-1 -...

org.springframework.boot:spring-boot-starter-data-rest (1.5.5.release), org.springframework.data:spring-data-rest-hal-browser (2.6.5.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.boot:spring-boot-starter-data-rest (>=1.5.11.release, <=1.5.12.release), org.springframework.data:spring-data-rest-hal-browser (2.6.11.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

EUVD-2026-35908

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

org.springframework.boot:spring-boot-starter-data-rest (>=1.1.11.release, <=1.1.12.release), org.springframework.data:spring-data-rest-webmvc (2.1.5.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.1.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.cloud:spring-cloud-starter-stream-kafka11 (1.3.0.release), org.springframework.cloud:spring-cloud-stream-binder-kafka-0.11-test (1.3.0.release) +5 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-stream-kafka11 1.3.0.release...

io.github.gracefullliam:paopao-log (>=alpha, <=1.0.0.release), io.github.shuigedeng:taotao-cloud-starter-mq-pulsar (>=2023.05, <=2023.11) +4 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (0.2.0)

org.springframework.pulsar:spring-pulsar MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.pulsar:spring-pulsar and may be impacted: - io.github.gracefullliam:paopao-log =alpha, =2023.05, =2023.11 -...

org.springframework.boot:spring-boot-starter-data-rest (>=1.0.0.release, <=1.0.1.release), org.springframework.data:spring-data-rest-webmvc (2.0.1.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.0.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.eventasia:eventasia-stream-kafka (>=0.0.12.release, <=0.0.13.release), org.apereo.cas:cas-server-core-configuration-cloud-kafka (>=5.1.0-rc4, <=5.1.9) +1 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:eventasia-stream-kafka =0.0.12.release, =5.1.0-rc4,...

org.springframework.cloud:spring-cloud-starter-bus-kafka (1.3.1.release), org.springframework.cloud:spring-cloud-stream-docs (chelsea.sr2) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.4.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-bus-kafka 1.3.1.release -...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (1.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-repository...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41730 Source advisory: OSV:GHSA-P5MM-XWGQ-WHFRhttps://vulners.c...

org.springframework.pulsar:spring-pulsar-reactive (0.1.0), org.springframework.pulsar:spring-pulsar-reactive-spring-boot-starter (0.1.0) +1 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (0.1.0)

org.springframework.pulsar:spring-pulsar MAVEN version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.pulsar:spring-pulsar and may be impacted: - org.springframework.pulsar:spring-pulsar-reactive 0.1.0 -...

Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

at.researchstudio.sat:won-core (>=0.4, <=0.9), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +88 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.16.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.researchstudio.sat:won-core =0.4, =0.4, =0.4, =0.4, =0.4,...

com.aol.microservices:micro-dbcp (>=0.79, <=0.84), com.aol.microservices:micro-hibernate (>=0.73, <=0.84) +54 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.11.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:micro-dbcp =0.79, =0.73, =0.78, =0.73,...