Description

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

This issue can occur if an application explicitly exposes an endpoint that accepts Sort parameters from untrusted sources and passes them on without performing sanitization or if the application exposes endpoints with parameters annotated with @ProjectedPayload or @QuerydslPredicate.

Spring Data Commons does not directly expose this API to untrusted callers; exposure depends on the consuming Spring Data module or application code.

Affected Spring Products and Versions

Spring Data Commons:

4.0.0 to 4.0.5
3.5.0 to 3.5.11
3.4.0 to 3.4.14
3.3.0 to 3.3.16
3.2.0 to 3.2.15
3.1.0 to 3.1.14
3.0.0 to 3.0.15
2.7.0 to 2.7.19
older unsupported versions

Mitigation

Users of affected versions should upgrade to the corresponding fixed version. Ensure that any untrusted input intended for sorting is adequately sanitized before being processed.