AIKIDO-2026-11185
spring-data-commons is vulnerable to Uncontrolled Resource Consumption
59
Medium Risk
This Affects:
spring-data-commonsTL;DR
Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. This issue can occur if an application explicitly exposes an endpoint that accepts Sort parameters from untrusted sources and passes them on without performing sanitization or if the application exposes endpoints with parameters annotated with @ProjectedPayload or @QuerydslPredicate. Spring Data Commons does not directly expose this API to untrusted callers; exposure depends on the consuming Spring Data module or application code.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-data-commons is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 2.7.19, 3.0.0 - 3.3.16, 3.4.0 - 3.4.14, 3.5.0 - 3.5.11 and 4.0.0 - 4.0.5.
How to fix this
Upgrade the org.springframework.data:spring-data-commons library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant