CVE-2026-41716: Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

Synopsis

An unbounded cache-poisoning denial-of-service vulnerability affects Spring Data Commons. The affected component accepts attacker-supplied property-name strings as permanent cache keys over the network, requiring no authentication. Successful exploitation exhausts JVM heap memory, crashing or rendering the application unavailable. Patched-image rebuilds at versions 2.7.20, 3.3.17, 3.4.15, 3.5.12, and 4.0.6 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable cache endpoint is reachable over the network; an attacker must be able to send HTTP requests to the exposed Spring Data web layer.

• AuthenticationNot required

  No credentials or session token are needed; unauthenticated requests carrying arbitrary property-name strings are sufficient to populate the cache.

• Victim interactionNot required

  No user action is required; the attacker drives the attack entirely through their own requests to the service.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the attacker simply sends repeated requests with novel string keys and the cache grows without bound.

Blast Radius

• The JVM heap fills as the cache grows, triggering out-of-memory errors and crashing the application process.
• All in-flight requests are dropped when the service goes down, causing a full denial of service for end users.
• Persistent heap pressure before a full crash causes severe latency degradation, making the application effectively unusable during the attack.