CVE-2026-41695 describes a denial of service vulnerability in Spring Data Commons caused by uncontrolled resource consumption (CWE-400). The issue occurs when attacker-controlled property path strings are processed by the MappingContext property path resolution mechanism, which can exhaust system resources and cause service disruption. Affected versions include 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network exploitable, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No vendor advisory or patch information is currently provided.

Successful exploitation can cause denial of service through resource exhaustion, impacting the availability of applications using affected Spring Data Commons versions. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying input validation or limiting the complexity and length of property path strings passed to MappingContext property path resolution to mitigate potential resource exhaustion. Monitor vendor communications for updates.