THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-88fw-v6x4-3f58 (high) — Spring Data: Unbounded property-path cache keyed by externally-supplied path string

[GHSA] GHSA-88fw-v6x4-3f58 (high) — Spring Data: Unbounded property-path cache keyed by externally-supplied path string

medgithub_advisoriesPublished 2026-07-31

GHSA-88fw-v6x4-3f58 Severity: high CVE: CVE-2026-41695

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

`src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175` · Unbounded Resource Allocation (Algorithmic DoS)

### Impact

When a consuming module routes user-supplied dot-paths (sort parameters, projection paths, PATCH pat

Indicators of compromise

Original source: https://github.com/advisories/GHSA-88fw-v6x4-3f58