GHSA-9fw2-h3hf-293r

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.

Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-12T16:10:38Z",
    "nvd_published_at":  "2026-06-10T00:16:51Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven

org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.6

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

Database specific

last_known_affected_version_range

"<= 4.0.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fw2-h3hf-293r/GHSA-9fw2-h3hf-293r.json"

org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.5.0

Fixed

3.5.12

Affected versions

3.*

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.5.7

3.5.8

3.5.9

3.5.10

3.5.11

Database specific

last_known_affected_version_range

"<= 3.5.11"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fw2-h3hf-293r/GHSA-9fw2-h3hf-293r.json"

org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.4.0

Last Affected

3.4.14

Affected versions

3.*

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.4.9

3.4.10

3.4.11

3.4.12

3.4.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fw2-h3hf-293r/GHSA-9fw2-h3hf-293r.json"

org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.3.0

Last Affected

3.3.16

Affected versions

3.*

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

3.3.8

3.3.9

3.3.10

3.3.11

3.3.12

3.3.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fw2-h3hf-293r/GHSA-9fw2-h3hf-293r.json"

org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.7.19

Affected versions

1.*

1.5.0.RELEASE

1.5.1.RELEASE

1.5.2.RELEASE

1.5.3.RELEASE

1.6.0.RELEASE

1.6.1.RELEASE

1.6.2.RELEASE

1.6.3.RELEASE

1.6.4.RELEASE

1.6.5.RELEASE

1.7.0.RELEASE

1.7.1.RELEASE

1.7.2.RELEASE

1.7.3.RELEASE

1.8.0.RELEASE

1.8.1.RELEASE

1.8.2.RELEASE

1.8.4.RELEASE

1.8.5.RELEASE

1.8.6.RELEASE

1.9.0.RELEASE

1.9.1.RELEASE

1.9.2.RELEASE

1.9.3.RELEASE

1.9.4.RELEASE

1.10.0.RELEASE

1.10.1.RELEASE

1.10.2.RELEASE

1.11.0.RELEASE

1.11.1.RELEASE

1.11.2.RELEASE

1.11.4.RELEASE

1.11.5.RELEASE

1.11.6.RELEASE

1.12.0.RELEASE

1.12.1.RELEASE

1.12.2.RELEASE

1.12.3.RELEASE

1.12.4.RELEASE

1.12.5.RELEASE

1.12.6.RELEASE

1.12.7.RELEASE

1.12.8.RELEASE

1.12.9.RELEASE

1.12.10.RELEASE

1.12.11.RELEASE

1.13.0.RELEASE

1.13.1.RELEASE

1.13.2.RELEASE

1.13.3.RELEASE

1.13.4.RELEASE

1.13.5.RELEASE

1.13.6.RELEASE

1.13.7.RELEASE

1.13.8.RELEASE

1.13.9.RELEASE

1.13.10.RELEASE

1.13.11.RELEASE

1.13.12.RELEASE

1.13.13.RELEASE

1.13.14.RELEASE

1.13.15.RELEASE

1.13.16.RELEASE

1.13.17.RELEASE

1.13.18.RELEASE

1.13.20.RELEASE

1.13.21.RELEASE

1.13.22.RELEASE

1.13.23.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.0.7.RELEASE

2.0.8.RELEASE

2.0.9.RELEASE

2.0.10.RELEASE

2.0.11.RELEASE

2.0.12.RELEASE

2.0.13.RELEASE

2.0.14.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.1.7.RELEASE

2.1.8.RELEASE

2.1.9.RELEASE

2.1.10.RELEASE

2.1.11.RELEASE

2.1.12.RELEASE

2.1.13.RELEASE

2.1.14.RELEASE

2.1.15.RELEASE

2.1.16.RELEASE

2.1.17.RELEASE

2.1.18.RELEASE

2.1.19.RELEASE

2.1.20.RELEASE

2.1.21.RELEASE

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

2.2.4.RELEASE

2.2.5.RELEASE

2.2.6.RELEASE

2.2.7.RELEASE

2.2.8.RELEASE

2.2.9.RELEASE

2.2.10.RELEASE

2.2.11.RELEASE

2.2.12.RELEASE

2.2.13.RELEASE

2.3.0.RELEASE

2.3.1.RELEASE

2.3.2.RELEASE

2.3.3.RELEASE

2.3.4.RELEASE

2.3.5.RELEASE

2.3.6.RELEASE

2.3.7.RELEASE

2.3.8.RELEASE

2.3.9.RELEASE

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.4.10

2.4.11

2.4.12

2.4.13

2.4.14

2.4.15

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9

2.5.10

2.5.11

2.5.12

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.6.9

2.6.10

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.7.8

2.7.9

2.7.10

2.7.11

2.7.12

2.7.13

2.7.14

2.7.15

2.7.16

2.7.17

2.7.18

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fw2-h3hf-293r/GHSA-9fw2-h3hf-293r.json"