Spring Data Commons contains a vulnerability (CWE-770) where its internal property-lookup cache accepts attacker-controlled strings as cache keys and retains them indefinitely. This can be exploited by sending repeated requests with unique strings to exhaust heap memory, leading to denial of service. The vulnerability affects multiple version ranges of Spring Data Commons from 2.7.0 up to and including 2.7.19, 3.3.0 up to 3.3.16, 3.4.0 up to 3.4.14, 3.5.0 up to 3.5.11, and 4.0.0 up to 4.0.5. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). There is no vendor advisory or patch available at this time.

The vulnerability allows an unauthenticated attacker to cause denial of service by exhausting heap memory through repeated requests that add attacker-controlled strings to the internal cache. This impacts availability but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing request rate limiting or other controls to mitigate the risk of heap exhaustion from repeated requests with unique cache keys.