{"id":"CVE-2018-1274","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-1274","generatedAt":"2026-10-28T23:58:07.559Z","title":"Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation.","description":"Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).","published":"2018-04-18T16:29:00.000Z","lastModified":"2026-06-26T18:44:15.000Z","status":"Analyzed","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-770"],"affected":["broadcom/spring data commons","pivotal software/spring data rest","vmware/spring data rest"],"epss":{"score":0.01925,"percentile":0.79845,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/103769","tags":["Broken Link"],"source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2018-1274","tags":["Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/103769","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2018-1274","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1274","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}