Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.

Specifically, an application is vulnerable when all of the following are true:

• attacker-controlled input is used as a property path string for path resolution
• the consuming module or application exposes this resolution to untrusted callers (for example, when using Spring Data REST)
• the targeted domain types contain recursive or sufficiently deeply nested property graphs, or attackers can submit a large number of unique invalid paths

Spring Data Commons does not directly expose this API to untrusted callers; exposure depends on the consuming Spring Data module or application code.