CVE-2026-41695: Denial of Service in Spring Data Commons Property Path Resolution

Synopsis

This is a denial-of-service vulnerability in Spring Data Commons caused by unbounded resource exhaustion during property path resolution. An unauthenticated remote attacker can trigger it by sending crafted property path strings to any exposed endpoint that passes user input into MappingContext property path resolution, requiring no privileges or victim interaction. Successful exploitation exhausts server resources and crashes or hangs the affected service. A patched-image rebuild at versions 3.4.15, 3.5.12, and 4.0.6 is available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable Spring Data Commons service over the network, as the CVSS vector specifies AV:N (network-adjacent access is not sufficient; the service must be reachable from wherever the attacker originates).

• AuthenticationNot required

  No credentials or session token are needed; the CVSS vector specifies PR:N, meaning any unauthenticated request carrying a crafted property path string is sufficient.

• Victim interactionNot required

  The exploit is fully server-side; no user action such as clicking a link or opening a file is required, as the CVSS vector specifies UI:N.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• The affected service exhausts CPU or memory (or both) while processing the crafted property path, causing it to become unresponsive or crash.
• Dependent services or clients that rely on the Spring Data Commons endpoint lose connectivity for the duration of the resource exhaustion event.
• No confidentiality or integrity impact is indicated; the attacker cannot read or modify data, only disrupt availability.