https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-41721.htmlhttps://patchthecve.com/cve/CVE-2026-41721.htmlThu, 23 Jul 2026 09:10:00 +0000MEDIUM 5.9: Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lothttps://patchthecve.com/cve/CVE-2026-41716.htmlhttps://patchthecve.com/cve/CVE-2026-41716.htmlThu, 23 Jul 2026 09:10:00 +0000HIGH 7.5: Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.https://patchthecve.com/cve/CVE-2026-41711.htmlhttps://patchthecve.com/cve/CVE-2026-41711.htmlThu, 23 Jul 2026 09:10:00 +0000MEDIUM 5.9: Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through https://patchthecve.com/cve/CVE-2026-41695.htmlhttps://patchthecve.com/cve/CVE-2026-41695.htmlThu, 23 Jul 2026 09:10:00 +0000HIGH 7.5: Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3