Spring Data Commons resolves property paths supplied by applications. An attacker can supply a specially crafted property path that causes the resolution algorithm to consume excessive CPU or memory, leading to service slowdown or failure. The vulnerability enables a denial‑of‑service condition without requiring authentication or elevated privileges. The weakness is a classic resource‑exhaustion fault marked by CWE‑400.

The flaw affects the Spring publisher’s Spring Data Commons library in multiple major releases, specifically versions 4.0.0‑4.0.5, 3.5.0‑3.5.11, and 3.4.0‑3.4.14. Applications built with any of these releases are at risk.

With a CVSS score of 7.5 the risk is considered high. No EPSS score is available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is through attacker‑controlled input—property path strings that an application processes during request handling. Because no authentication is required, any external request that reaches the vulnerable code can trigger the resource exhaustion. No public exploits have been confirmed, but the severity suggests the vulnerability could be actively targeted in a high‑traffic environment.