CVE-2026-41711 is a vulnerability in Spring Data Commons where parsing of Sort parameters can lead to uncontrolled resource consumption resulting in a Denial of Service condition through a StackOverflowException. The affected versions include 2.7.0 through 2.7.19, 3.0.0 through 3.0.15, 3.1.0 through 3.1.14, 3.2.0 through 3.2.15, 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Successful exploitation of this vulnerability can cause a Denial of Service by triggering a StackOverflowException during the parsing of Sort parameters, impacting application availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Users should monitor vendor communications for updates and consider limiting or validating Sort parameter inputs as a precautionary measure.