Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. org.springframework.data/spring-data-commons
  4. ›
  5. CVE-2026-41711

CVE-2026-41711: Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

June 10, 2026 (updated August 12, 2026)

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

References

  • github.com/advisories/GHSA-5vpf-xvv7-c8vh
  • github.com/spring-projects/spring-data-commons/releases/tag/3.5.12
  • github.com/spring-projects/spring-data-commons/releases/tag/4.0.6
  • nvd.nist.gov/vuln/detail/CVE-2026-41711
  • spring.io/security/cve-2026-41711

Code Behaviors & Features

Detect and mitigate CVE-2026-41711 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 2.7.19, all versions starting from 3.0.0 up to 3.3.16, all versions starting from 3.4.0 up to 3.4.14, all versions starting from 3.5.0 before 3.5.12, all versions starting from 4.0.0 before 4.0.6

Fixed versions

  • 3.5.12
  • 4.0.6

Solution

Upgrade to versions 3.5.12, 4.0.6 or above.

Impact 5.9 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption

Source file

maven/org.springframework.data/spring-data-commons/CVE-2026-41711.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Fri, 14 Aug 2026 12:19:23 +0000.