exploitDog

CVE-2026-41716

Опубликовано: 10 июн. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.

Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

Ссылки

https://spring.io/security/cve-2026-41716
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*

Версия от 2.7.0 (включая) до 2.7.20 (исключая)

cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*

Версия от 3.3.0 (включая) до 3.3.17 (исключая)

cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*

Версия от 3.4.0 (включая) до 3.4.15 (исключая)

cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*

Версия от 3.5.0 (включая) до 3.5.11.1 (исключая)

cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.0.5.1 (исключая)

EPSS

Процентиль: 28%

0.00363

Низкий

7.5 High

CVSS3

Дефекты

CWE-770

Связанные уязвимости

CVE-2026-41716

CVSS3: 7.5

redhat

2 месяца назад

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

GHSA-9fw2-h3hf-293r

CVSS3: 7.5

github

2 месяца назад

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

EPSS

Процентиль: 28%

0.00363

Низкий

7.5 High

CVSS3

Дефекты

CWE-770