Spring Data Commons contains a vulnerability (CWE-770) where its internal property-lookup cache accepts attacker-controlled strings as cache keys and retains them permanently. This can be exploited by sending repeated requests with unique strings, leading to unbounded memory allocation and heap exhaustion. The vulnerability affects multiple version ranges of Spring Data Commons as listed. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

The vulnerability allows an unauthenticated remote attacker to cause denial of service by exhausting heap memory through repeated requests that cause unbounded cache growth. This impacts the availability of applications using affected versions of Spring Data Commons. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing rate limiting or request throttling at the application or network level to reduce the risk of heap exhaustion from repeated requests with unique cache keys.