CVE-2026-41716
HighAdvisory
Published 10 Jun 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.004
- 30th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 122
- of 17,781 indexed, latest versions
- Container images
- 134
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys
Carried by container images the latest versions of 122 of 17,781 indexed charts deploy, on 134 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-data-commonsmaven | 1.12.2.RELEASE, 1.12.4.RELEASE, 1.13.14.RELEASE, 1.13.16.RELEASE+61 more | 3.5.12, 4.0.6 | 134 |
- OSV records
- GHSA-9fw2-h3hf-293r
Charts affected
122 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| jiraatlassian-data-centerVerified publisher | 2.0.15 | 1 of 2See more | 1,490 |
| rocketmqrocketmq | 12.6.0 | 1 of 2See more | 6,328 |
| apim3graviteeioVerified publisher | 4.12.19 | 2 of 4See more | 4,806 |
| microcksmicrocksOfficialVerified publisher | 0.8.0-helm-3.kube-1.17 | 1 of 5See more | 10,732 |
| spring-petclinic-cloudplatform9-communityVerified publisher | 0.2.0 | 3 of 6See more | 41,872 |
| unifiunifiVerified publisher | 1.16.0 | 1 of 1See more | 7,268 |
| jira-softwaremoxVerified publisher | 2.7.1 | 1 of 3See more | 8,636 |
| hertzbeathertzbeatOfficialVerified publisher | 1.8.1 | 2 of 4See more | 14,000 |
| unifi-controllerqonstruktVerified publisher | 2.6.1 | 1 of 1See more | 10,469 |
| thingsboardcetic | 0.1.2 | 1 of 2See more | 5,235 |
| unifigeek-cookbookVerified publisher | 5.1.3 | 1 of 1See more | 11,839 |
| rocketmqgin | 1.1.0 | 1 of 2See more | 9,154 |
| apimgraviteeioVerified publisher | 4.12.19 | 2 of 4See more | 4,806 |
| nzbhydra2halkeye | 2.30.1 | 1 of 2See more | 6,711 |
| rocketmq-clusterrocketmq | 12.6.0 | 1 of 2See more | 6,328 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,566 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 1 of 10See more | 28,534 |
| structurizrvirtualrootVerified publisher | 0.5.0 | 1 of 1See more | 4,378 |
| cbioportalcbioportalOfficialVerified publisher | 1.1.0 | 1 of 1See more | 3,674 |
| cert-vaultcert-vaultOfficialVerified publisher | 2.12.0 | 1 of 7See more | 15,863 |
| ignitecloudnativeapp | 1.0.0 | 1 of 1See more | 7,891 |
| enavenav-service-architectureVerified publisher | 0.0.7 | 5 of 10See more | 15,860 |
| omada-controllergeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 11,553 |
| amgraviteeioVerified publisher | 4.12.6 | 2 of 3See more | 2,088 |
| gridgaingridgainOfficialVerified publisher | 1.0.6 | 1 of 1See more | 4,679 |
| Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher | 1.0.1 | 1 of 6See more | 19,187 |
| todo-apipavanelthepu | 0.1.0 | 1 of 2See more | 2,544 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 31,844 |
| shinyproxyremche | 0.6.6 | 1 of 2See more | 3,958 |
| reservation-appreservation-app | 1.0.9 | 1 of 4See more | 6,639 |
| seldon-coreseldon | 0.2.7 | 1 of 3See more | 13,798 |
| querysiakhooiVerified publisher | 1.0.0 | 1 of 1See more | 1,792 |
| starwhalestarwhaleVerified publisher | 0.6.15 | 1 of 4See more | 13,486 |
| airsonic-advancedairsonic-advancedVerified publisher | 0.3.1 | 1 of 1See more | 1,748 |
| omada-controllerandrelote-k8sVerified publisher | 4.5.0 | 1 of 1See more | 11,553 |
| apimap-apiapimapOfficialVerified publisher | 1.8.11 | 1 of 1See more | 2,231 |
| d.vazquezm.2021_helmapphelmVerified publisher | 1.0.0 | 1 of 6See more | 19,745 |
| chart-app-vidapp-vid-chartVerified publisher | 0.0.7 | 1 of 2See more | 8,866 |
| url-shortenerbeastob | 1.0.2 | 1 of 3See more | 3,607 |
| blackduck-alertblackduck | 8.4.0 | 1 of 4See more | 4,292 |
| bluerange-serverbluerangeOfficialVerified publisher | 1.3.1 | 1 of 1See more | 1,816 |
| colosseumbook-k8sinfra-v2 | 1.0.18 | 1 of 5See more | 26,996 |
| category-microservicebusi-adsVerified publisher | 1.0.0 | 1 of 2See more | 11,869 |
| robot-shopcloud-native-toolkit | 1.1.1 | 1 of 12See more | 29,555 |
| dara-chartsdara-charts | 0.1.0 | 1 of 2See more | 3,547 |
| eoloplannerdfa-amm-eoloplannerVerified publisher | 0.1.0 | 1 of 7See more | 27,550 |
| eoloplannerdreyg-jescribanob-chart-eoloplanner | 0.1.0 | 1 of 7See more | 24,656 |
| unifiegebackVerified publisher | 2.1.6 | 1 of 1See more | 7,268 |
| eolicplantseolicplantsVerified publisher | 0.1.0 | 1 of 7See more | 27,291 |
| eoloplanner-mcaeoloplanner-mcaVerified publisher | 0.1.0 | 1 of 7See more | 27,256 |
Container images carrying it
134 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| someblackmagic/ | 0d63ba37a560 | spring-data-commons | no fix listed | 1 |
| structurizr/ | 4b5ffb5119c8 | spring-data-commons | no fix listed | 1 |
| sysnet4admin/ | bc25b152d88e | spring-data-commons | no fix listed | 1 |
| thingsboard/ | bd45a09d85d9 | spring-data-commons | no fix listed | 1 |
| thingsboard/ | a06f53c5e2da | spring-data-commons | no fix listed | 1 |
| thingsboard/ | 030f316ce301 | spring-data-commons | no fix listed | 1 |
| thingsboard/ | 645f43b688f7 | spring-data-commons | no fix listed | 1 |
| thingsboard/ | f40a542832c4 | spring-data-commons | no fix listed | 1 |
| thingsboard/ | 2d17e4e36edc | spring-data-commons | no fix listed | 1 |
| thmmniii/ | 5438517d9fc2 | spring-data-commons | no fix listed | 1 |
| torrespro/ | 6d3bd305a1ba | spring-data-commons | no fix listed | 1 |
| treskon/ | 88e813f22347 | spring-data-commons | no fix listed | 1 |
| vlebediantsev/ | 10393a89b4a8 | spring-data-commons | no fix listed | 1 |
| vlebediantsev/ | df8bf38c535b | spring-data-commons | no fix listed | 1 |
| vlebediantsev/ | 427af418b75e | spring-data-commons | no fix listed | 1 |
| vlebediantsev/ | 9319437f3c8f | spring-data-commons | no fix listed | 1 |
| zahoriaut/ | b2de13916f3e | spring-data-commons | no fix listed | 1 |
| zbalogh/ | 7c247e399a1f | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | acb8dbce38fd | spring-data-commons | 4.0.6 | 1 |
| ghcr.io/ | cf85570b1324 | spring-data-commons | 4.0.6 | 1 |
| ghcr.io/ | 3be878690629 | spring-data-commons | 4.0.6 | 1 |
| ghcr.io/ | f1629ac5f9ec | spring-data-commons | 4.0.6 | 1 |
| ghcr.io/ | 415323ef112b | spring-data-commons | 4.0.6 | 1 |
| ghcr.io/ | c4c52955814f | spring-data-commons | 4.0.6 | 1 |
| ghcr.io/ | a7d0cc9e260a | spring-data-commons | 3.5.12 | 1 |
| ghcr.io/ | 5de339b3d537 | spring-data-commons | 3.5.12 | 1 |
| ghcr.io/ | b52ff07f9f0c | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | ef3670f7e0a8 | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | cdc0658c40fb | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | c1b37e821f72 | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | 41b45003c6b6 | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | 8368359c8dd0 | spring-data-commons | no fix listed | 1 |
| ghcr.io/ | 3b3670fce70b | spring-data-commons | 4.0.6 | 1 |
| public.ecr.aws/ | e85f034bcf48 | spring-data-commons | 3.5.12 | 1 |