High severity · published Apr 18, 2018
CVE-2018-1274
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation
7.5
CVSS
1.9%
EPSS
No
On KEV
Description
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Spring Data Commons · Broadcom
before 1.13.11; 2.0.0 before 2.0.6 · source: NVD
SD
Spring Data Rest · Pivotal Software
3.0 through 3.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1274
Broken Link
http://www.securityfocus.com/bid/103769
Vendor Advisory
https://pivotal.io/security/cve-2018-1274
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
More from Spring Data Commons
9.8
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of…
7.5
CVE-2026-41716
Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names
7.5
CVE-2026-41695
Denial of Service in Spring Data Commons Property Path Resolution
7.5
CVE-2018-1259
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability…
5.9
CVE-2026-41721
Spring Data Commons Denial of Service via Data Binding