Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.data:spring-data-commons

7 known vulnerabilities (1 critical, 2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
4.1.2 (Oct 22, 2026): no advisory affects it
Newest unaffected release
4.1.2 (Oct 22, 2026), the latest release
Advisories
7 · 1 critical, 2 high, 2 medium
Dependents
742
Releases
296 since 1.5.0.RELEASE (Feb 7, 2013)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-41721
    Affects 1.5.0.RELEASE to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it)
  • CVE-2026-41716
    Affects 1.5.0.RELEASE to 2.7.18 (3.0.0 is outside it); 3.3.0 to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it)
  • CVE-2026-41711
    Affects 1.5.0.RELEASE to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it)
  • CVE-2026-41695
    Affects 3.4.0 to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it)
  • CVE-2018-1259
    Affects 1.13.0.RELEASE to 1.13.11.RELEASE (1.13.12.RELEASE is outside it); 2.0.0.RELEASE to 2.0.6.RELEASE (2.0.7.RELEASE is outside it)
  • CVE-2018-1274
    Affects 1.5.0.RELEASE to 1.13.10.RELEASE (1.13.11.RELEASE is outside it); 2.0.0.RELEASE to 2.0.5.RELEASE (2.0.6.RELEASE is outside it)
  • CVE-2018-1273
    Affects 1.13.0.RELEASE to 1.13.10.RELEASE (1.13.11.RELEASE is outside it); 2.0.0.RELEASE to 2.0.5.RELEASE (2.0.6.RELEASE is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • CVE-2026-41721Medium 5.9

    Spring Data Commons Denial of Service via Data Binding

    Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.14; from 3.0.0, through 3.3.16; through 2.7.19.

    Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure).

    The latest release, 4.1.2, is not affected.

  • Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

    Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.14; from 3.3.0, through 3.3.16; through 2.7.19.

    Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure).

    The latest release, 4.1.2, is not affected.

  • CVE-2026-41711Medium 5.9

    Potential Denial of Service through crafted Sort Parameters

    Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.14; from 3.0.0, through 3.3.16; through 2.7.19.

    Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure).

    The latest release, 4.1.2, is not affected.

  • Denial of Service in Spring Data Commons Property Path Resolution

    Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.13.

    Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure).

    The latest release, 4.1.2, is not affected.

  • Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions…

    Affected: from 1.13.0, fixed in 1.13.12; from 2.0.0, fixed in 2.0.7.

    Fixed in 1.13.12.RELEASE (released May 8, 2018, 3 days before disclosure) and 2.0.7.RELEASE (released May 8, 2018, 3 days before disclosure).

    The latest release, 4.1.2, is not affected.

  • Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability…

    Affected: fixed in 1.13.11; from 2.0.0, fixed in 2.0.6.

    Fixed in 1.13.11.RELEASE (released Apr 4, 2018, 14 days before disclosure) and 2.0.6.RELEASE (released Apr 4, 2018, 14 days before disclosure).

    The latest release, 4.1.2, is not affected.

  • CVE-2018-1273Critical 9.8 · KEV

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit

    Affected: from 1.13.0, fixed in 1.13.11; from 2.0.0, fixed in 2.0.6.

    Fixed in 1.13.11.RELEASE (released Apr 4, 2018, 7 days before disclosure) and 2.0.6.RELEASE (released Apr 4, 2018, 7 days before disclosure).

    The latest release, 4.1.2, is not affected.