Resource allocation without limits in Spring Framework
Priority LOW 37CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Why it matters now
EPSS 0.01941 80th percentileScored 2026-11-07
Fix Partial org.springframework.data:spring-data-commons (Maven): 1.13.11, 2.0.6Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Spring by Pivotal | Spring Framework | Versions 1.13 to 1.13.10, 2.0 to 2.0.5 | — | No fix listed | CNA |
| — | org.springframework.data:spring-data-commons (Maven) | before 1.13.11 | 1.13.11 | Patch available | GHSA-5q8m-mqmx-pxp9 |
| — | org.springframework.data:spring-data-commons (Maven) | 2.0.0 to before 2.0.6 | 2.0.6 | Patch available | GHSA-5q8m-mqmx-pxp9 |
- Spring Framework VendorSpring by Pivotal Affected Versions 1.13 to 1.13.10, 2.0 to 2.0.5 Fixed in — No fix listed CNA
- org.springframework.data:spring-data-commons (Maven) Vendor— Affected before 1.13.11 Fixed in 1.13.11 Patch available GHSA-5q8m-mqmx-pxp9
- org.springframework.data:spring-data-commons (Maven) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-5q8m-mqmx-pxp9
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* | before 1.13.11; 2.0.0 to before 2.0.6 | Vulnerable | Broadcom |
| cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* | 3.0 – 3.0.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* | 2.6 – 2.6.10 | Vulnerable | VMware |
- cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* Versions before 1.13.11; 2.0.0 to before 2.0.6 Vulnerable ·Broadcom
- cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* Versions 3.0 – 3.0.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* Versions 2.6 – 2.6.10 Vulnerable ·VMware
Remediation
- Fix · GHSA-5q8m-mqmx-pxp9 org.springframework.data:spring-data-commons (Maven) Fixed in 1.13.11 Advisory →
- Fix · GHSA-5q8m-mqmx-pxp9 org.springframework.data:spring-data-commons (Maven) Fixed in 2.0.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
Not affected: 3 products
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Integration Service 2
- Red Hat Mobile Application Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1274
- 2026-10-03 Alias added: GHSA-5q8m-mqmx-pxp9
References
Advisory 4
More Spring by Pivotal Spring Data Rest vulnerabilities
- TI-2018-01178 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
- TI-2018-01164 XML external entity injection in Pivotal Spring Data Commons CVSS 3.0HIGH 7.5
Sources
- CVE-2018-1274 · CVE Program
- CVE-2018-1274 · NVD
- FIRST EPSS
- GHSA-5q8m-mqmx-pxp9 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1274 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences