CVE-2026-41721
MediumAdvisory
Published 10 Jun 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.003
- 26th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 155
- of 17,781 indexed, latest versions
- Container images
- 157
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Carried by container images the latest versions of 155 of 17,781 indexed charts deploy, on 157 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-data-commonsmaven | 1.12.2.RELEASE, 1.12.4.RELEASE, 1.13.14.RELEASE, 1.13.16.RELEASE+73 more | 3.5.12, 4.0.6 | 157 |
- OSV records
- GHSA-5m4m-73w9-8433
Charts affected
155 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| webapp-db-javawebapp-db-java-repo | 0.1.0 | 1 of 2See more | 2,566 |
| webhookiewebhookie | 0.1.2 | 1 of 1See more | 14,364 |
| webhookie-allwebhookie | 0.1.2 | 1 of 3See more | 28,605 |
| workshop-pipelinesworkshop-pipelines | 0.1.6 | 1 of 2See more | 11,577 |
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
Container images carrying it
157 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| fjvela/ | 70cebf67bd66 | spring-data-commons | no fix listed | 1 |
| folioci/ | 0cc86bf09755 | spring-data-commons | 4.0.6 | 1 |
| folioci/ | f1d7caf4544b | spring-data-commons | 4.0.6 | 1 |
| folioci/ | 1ad1811c9b37 | spring-data-commons | 4.0.6 | 1 |
| folioci/ | b55696fd9065 | spring-data-commons | no fix listed | 1 |
| gdrocha/ | d5ae64e83d4c | spring-data-commons | no fix listed | 1 |
| geonetwork/ | 20c9bb761f67 | spring-data-commons | no fix listed | 1 |
| golenski/ | c863dcb0c513 | spring-data-commons | no fix listed | 1 |
| golenski/ | 3a2b36df247b | spring-data-commons | no fix listed | 1 |
| golenski/ | 954caf4aaf6a | spring-data-commons | no fix listed | 1 |
| gotson/ | 9b15ea6bfc30 | spring-data-commons | no fix listed | 1 |
| gotson/ | ba892ab3e082 | spring-data-commons | no fix listed | 1 |
| graviteeio/ | 07b7f6dc267a | spring-data-commons | no fix listed | 1 |
| graviteeio/ | a8eb04ee0c70 | spring-data-commons | no fix listed | 1 |
| gridgain/ | 5ab838d7d3cb | spring-data-commons | 3.5.12 | 1 |
| gridgain/ | d32d182a0e6a | spring-data-commons | no fix listed | 1 |
| gurolakman/ | 9abb3882bcbd | spring-data-commons | no fix listed | 1 |
| gurolakman/ | bf18525c5ad9 | spring-data-commons | no fix listed | 1 |
| hugohg34/ | 812a03b3f274 | spring-data-commons | no fix listed | 1 |
| intelloop/ | 4c61bc3dd3f8 | spring-data-commons | no fix listed | 1 |
| jacobalberty/ | 4a3616625dda | spring-data-commons | no fix listed | 1 |
| jacobalberty/ | b3edc809a3ff | spring-data-commons | no fix listed | 1 |
| jhipster/ | 7184525acd4d | spring-data-commons | no fix listed | 1 |
| jingking/ | 43e74ab234e1 | spring-data-commons | no fix listed | 1 |
| kimb88/ | 0639155241cb | spring-data-commons | no fix listed | 1 |
| kvalitetsit/ | f0af0ba589af | spring-data-commons | no fix listed | 1 |
| ladeit/ | 962b665ffe82 | spring-data-commons | no fix listed | 1 |
| lavandadelpatio/ | 94e225a5a6f8 | spring-data-commons | no fix listed | 1 |
| lavandadelpatio/ | 92de3c3426d2 | spring-data-commons | no fix listed | 1 |
| lavandadelpatio/ | 71f2ccec8c0d | spring-data-commons | no fix listed | 1 |
| lavandadelpatio/ | d2cba20aa4d8 | spring-data-commons | no fix listed | 1 |
| lavandadelpatio/ | 214eaef5444c | spring-data-commons | no fix listed | 1 |
| linuxserver/ | d286a7f55a59 | spring-data-commons | no fix listed | 1 |
| linuxserver/ | 0ae315a3a456 | spring-data-commons | no fix listed | 1 |
| linuxserver/ | ab105cc50322 | spring-data-commons | no fix listed | 1 |
| linuxserver/ | b6ce6968ee45 | spring-data-commons | 3.5.12 | 1 |
| maksimkavalenka/ | 64a25afb8748 | spring-data-commons | no fix listed | 1 |
| maksimkavalenka/ | 13ad9bb170a0 | spring-data-commons | no fix listed | 1 |
| maksimkavalenka/ | 2bcdac368b07 | spring-data-commons | no fix listed | 1 |
| microcks/ | e3a3e0c67b09 | spring-data-commons | no fix listed | 1 |
| openbas/ | d986d80b0a75 | spring-data-commons | no fix listed | 1 |
| operaton/ | b35867ffe4d8 | spring-data-commons | no fix listed | 1 |
| platform9community/ | 2089811e5cc6 | spring-data-commons | no fix listed | 1 |
| platform9community/ | d1165c94dfb3 | spring-data-commons | no fix listed | 1 |
| platform9community/ | 8d11b50368c6 | spring-data-commons | no fix listed | 1 |
| polyakov/ | dbcef69146b8 | spring-data-commons | no fix listed | 1 |
| razzy10/ | 702e411956db | spring-data-commons | 3.5.12 | 1 |
| redestroyder/ | db03499a0726 | spring-data-commons | no fix listed | 1 |
| refar/ | 241373fa2972 | spring-data-commons | no fix listed | 1 |
| remche/ | 8bcda8a04d3b | spring-data-commons | no fix listed | 1 |