Affected applications use Spring Data Commons to handle sorting of query results. A crafted Sort parameter can cause the framework to recurse indefinitely, eventually throwing a StackOverflowException. This exception terminates the request thread and can exhaust server resources, resulting in a denial of service for legitimate users. The weakness is a resource exhaustion issue described as CWE‑400.

Spring Data Commons products from Spring, serial numbers 4.0.0 through 4.0.5, 3.5.0 through 3.5.11, 3.4.0 through 3.4.14, 3.3.0 through 3.3.16, 3.2.0 through 3.2.15, 3.1.0 through 3.1.14, 3.0.0 through 3.0.15, and 2.7.0 through 2.7.19 are vulnerable. Any application incorporating those versions and exposing sorting calculations is at risk.

The CVSS score of 5.9 indicates moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, suggesting a lower confirmed exploitation probability at this time. However, because the vulnerability can be triggered by a simple HTTP request with a specially crafted Query string, it is plausible to exploit remotely against exposed APIs that pass Sort parameters through the framework. Until a patch is applied, the root cause remains exploitable.