AIKIDO-2026-11184
spring-data-commons is vulnerable to Allocation of Resources Without Limits or Throttling
75
High Risk
This Affects:
spring-data-commonsTL;DR
Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected applications are those using Spring Data features that forward HTTP-supplied strings to PropertyPath.from without prior filtering, in particular Querydsl web bindings (via QuerydslPredicateArgumentResolver) with the default permit-all visibility, and @ProjectedPayload form-parameter binding (via MapDataBinder).
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-data-commons is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.1 - 2.7.19, 3.0.0 - 3.3.16, 3.4.0 - 3.4.14, 3.5.0 - 3.5.11 and 4.0.0 - 4.0.5.
How to fix this
Upgrade the org.springframework.data:spring-data-commons library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant