org.springframework.data:spring-data-redis (1.8.2.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.8.2.release Sour...

org.dataone:d1_cn_common (2.3.0), org.sentilo.agent:sentilo-agent-activity-monitor (1.7.0) +10 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.6.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.dataone:d1cncommon 2.3.0 -...

EUVD-2026-35901

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

GHSA-5M4M-73W9-8433 Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

com.aol.microservices:micro-dbcp (>=0.79, <=0.84), com.aol.microservices:micro-hibernate (>=0.73, <=0.84) +54 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.11.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:micro-dbcp =0.79, =0.73, =0.78, =0.73,...

com.anbai:ab-elasticsearch (7.0.0), com.blazebit:blaze-persistence-examples-showcase-fragments-spring-data (1.6.7) +74 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.20.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.anbai:ab-elasticsearch 7.0.0 -...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +66 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.8.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =4.0....

com.github.akiraly.reusable-poms:pom-parent-with-spring-hibernate-querydsl (3), com.github.akiraly.reusable-poms:pom-parent-with-spring-hibernate-querydsl-core (3) +41 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.6.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: -...

com.ecfront.dew:cluster-spi-redis (1.2.2-rc), com.ecfront.dew:test-starter (1.2.2-rc) +45 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.6.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.ecfront.dew:cluster-spi-redis 1.2.2-rc -...

at.molindo:spring-data-custom (>=0.0.1, <=0.0.2), au.com.mountain-pass:hyperstate (>=1, <=3) +84 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.11.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.molindo:spring-data-custom =0.0.1, =1, =1.4, =1.4, =0.0.7,...

com.github.ydespreaux.spring.data:spring-data-jpa-criteria (1.0.1), com.wueasy:wueasy-base-web (>=1.2.0, <=1.3.3) +68 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.18.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.ydespreaux.spring.data:spring-data-jpa-criteria...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +3946 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.5.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

com.bq.corbel.lib:mongodb (>=0.7.0, <=0.9.1), com.bq.corbel.lib:queries (>=0.15.0, <=0.20.0) +212 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.9.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.bq.corbel.lib:mongodb =0.7.0, =0.15.0, =0.15.0, =0.15.0,...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2325 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41721 Source advisory: OSV:GHSA-5M4M-73W9-8433...

com.sangupta:jerry-services (1.0.0), com.soterianetworks:spase-audit-es (>=0.9.45, <=0.9.59) +20 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.10.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.sangupta:jerry-services 1.0.0 -...

at.researchstudio.sat:won-core (>=0.4, <=0.9), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +88 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.16.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.researchstudio.sat:won-core =0.4, =0.4, =0.4, =0.4, =0.4,...

org.springframework.data:spring-data-redis (1.7.0.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.0.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.7.0.release Sour...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +454 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.1, <=2.5), com.github.vencent-lu:giants-cache-redis (>=1.0.4, <=1.0.5-beta-7) +80 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.1, =1.0.4, =2.2.1...