AIKIDO-2026-11186
spring-data-commons is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
spring-data-commonsTL;DR
Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and requires attacker-controlled property path input, exposure to untrusted callers, and recursive/deeply nested domain graphs or many unique invalid paths.
Background info
spring-data-commons is vulnerable to Uncontrolled Resource Consumption in versions 3.4.0 - 3.4.14, 3.5.0 - 3.5.11 and 4.0.0 - 4.0.5.
How to fix this
Upgrade the org.springframework.data:spring-data-commons library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant