Broadcom Spring Data Commons vulnerabilities

7 CVEs affecting Broadcom Spring Data Commons, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41721, published 2026-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1273: VMware Tanzu Spring Data Commons Property Binder Vulnerability, published 2018-04-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 97% chance of exploitation in the next 30 days. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An…
CVE-2018-1259, published 2018-05-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper…
CVE-2018-1274, published 2018-04-18. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated…
CVE-2026-41716, published 2026-06-10. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring…
CVE-2026-41695, published 2026-06-10. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path…
CVE-2026-41721, published 2026-06-10. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using…
CVE-2026-41711, published 2026-06-10. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons…