# org.springframework.data:spring-data-commons (Maven) vulnerabilities 7 known vulnerabilities (1 critical, 2 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.1.2 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 4.1.2 (Oct 22, 2026), the latest release - Dependents: 742 - Releases: 296 since 1.5.0.RELEASE (Feb 7, 2013) - Registry: https://central.sonatype.com/artifact/org.springframework.data/spring-data-commons - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-41721: 1.5.0.RELEASE to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it) - CVE-2026-41716: 1.5.0.RELEASE to 2.7.18 (3.0.0 is outside it); 3.3.0 to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it) - CVE-2026-41711: 1.5.0.RELEASE to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it) - CVE-2026-41695: 3.4.0 to 3.5.11 (3.5.12 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it) - CVE-2018-1259: 1.13.0.RELEASE to 1.13.11.RELEASE (1.13.12.RELEASE is outside it); 2.0.0.RELEASE to 2.0.6.RELEASE (2.0.7.RELEASE is outside it) - CVE-2018-1274: 1.5.0.RELEASE to 1.13.10.RELEASE (1.13.11.RELEASE is outside it); 2.0.0.RELEASE to 2.0.5.RELEASE (2.0.6.RELEASE is outside it) - CVE-2018-1273: 1.13.0.RELEASE to 1.13.10.RELEASE (1.13.11.RELEASE is outside it); 2.0.0.RELEASE to 2.0.5.RELEASE (2.0.6.RELEASE is outside it) ## Advisories (7) ### [CVE-2026-41721](https://cve.now/CVE-2026-41721): Spring Data Commons Denial of Service via Data Binding - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.14; from 3.0.0, through 3.3.16; through 2.7.19. - Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure). - The latest release, 4.1.2, is not affected. ### [CVE-2026-41716](https://cve.now/CVE-2026-41716): Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names - Severity: High 7.5 - Published: Jun 9, 2026 - Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.14; from 3.3.0, through 3.3.16; through 2.7.19. - Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure). - The latest release, 4.1.2, is not affected. ### [CVE-2026-41711](https://cve.now/CVE-2026-41711): Potential Denial of Service through crafted Sort Parameters - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.14; from 3.0.0, through 3.3.16; through 2.7.19. - Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure). - The latest release, 4.1.2, is not affected. ### [CVE-2026-41695](https://cve.now/CVE-2026-41695): Denial of Service in Spring Data Commons Property Path Resolution - Severity: High 7.5 - Published: Jun 9, 2026 - Affected: from 4.0.0, fixed in 4.0.6; from 3.5.0, fixed in 3.5.12; from 3.4.0, through 3.4.13. - Fixed in 3.5.12 (released Jun 9, 2026, the day of disclosure) and 4.0.6 (released Jun 9, 2026, the day of disclosure). - The latest release, 4.1.2, is not affected. ### [CVE-2018-1259](https://cve.now/CVE-2018-1259): Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions… - Severity: Unrated - Published: May 11, 2018 - Affected: from 1.13.0, fixed in 1.13.12; from 2.0.0, fixed in 2.0.7. - Fixed in 1.13.12.RELEASE (released May 8, 2018, 3 days before disclosure) and 2.0.7.RELEASE (released May 8, 2018, 3 days before disclosure). - The latest release, 4.1.2, is not affected. ### [CVE-2018-1274](https://cve.now/CVE-2018-1274): Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability… - Severity: Unrated - Published: Apr 18, 2018 - Affected: fixed in 1.13.11; from 2.0.0, fixed in 2.0.6. - Fixed in 1.13.11.RELEASE (released Apr 4, 2018, 14 days before disclosure) and 2.0.6.RELEASE (released Apr 4, 2018, 14 days before disclosure). - The latest release, 4.1.2, is not affected. ### [CVE-2018-1273](https://cve.now/CVE-2018-1273): Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit - Severity: Critical 9.8 · KEV - Published: Apr 11, 2018 - Affected: from 1.13.0, fixed in 1.13.11; from 2.0.0, fixed in 2.0.6. - Fixed in 1.13.11.RELEASE (released Apr 4, 2018, 7 days before disclosure) and 2.0.6.RELEASE (released Apr 4, 2018, 7 days before disclosure). - The latest release, 4.1.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework.data:spring-data-commons Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.