Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

3 vulnerabilities found for Spring Data KeyValue by Spring

CVE-2026-41719 (GCVE-0-2026-41719)

Vulnerability from nvd – Published: 2026-06-09 23:48 – Updated: 2026-06-10 12:54
VLAI
Title
Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
Summary
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data KeyValue Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.7.0 , < 2.7.20 (custom)
Create a notification for this product.
Spring Spring Data Redis Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.7.0 , < 2.7.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T12:54:23.195850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T12:54:36.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data KeyValue",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data Redis",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
            }
          ],
          "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply unsanitized Sort input to a Spring Data KeyValue repository method using SpelPropertyComparator can inject arbitrary SpEL expressions."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:48:42.396Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41719"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41719",
    "datePublished": "2026-06-09T23:48:42.396Z",
    "dateReserved": "2026-04-22T06:21:37.021Z",
    "dateUpdated": "2026-06-10T12:54:36.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-0719

Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Spring Data KeyValue Data KeyValue versions 3.3.x antérieures à 3.3.17
Spring Data REST Data REST versions 4.3.x antérieures à 4.3.17
Spring Spring Data KeyValue Data KeyValue versions 3.4.x antérieures à 3.4.15
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.5.x antérieures à 3.5.12
Spring Spring Data Relational Data Relational versions 3.4.x antérieures à 3.4.15
Spring Spring AMQP AMQP versions 4.0.x antérieures à 4.0.4
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 4.0.x antérieures à 4.0.6
Spring Spring Data MongoDB Data MongoDB versions 3.4.x antérieures à 3.4.20
Spring Spring AMQP AMQP versions antérieures à 4.0.3.1
Spring Spring AMQP AMQP versions antérieures à 3.2.10.1
Spring Spring Data Relational Data Relational versions 3.3.x antérieures à 3.3.17
Spring Spring Data Relational Data Relational versions 4.0.x antérieures à 4.0.6
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.3.x antérieures à 3.3.17
Spring Spring Data KeyValue Data KeyValue versions 3.5.x antérieures à 3.5.12
Spring Spring AMQP AMQP versions 2.4.x antérieures à 2.4.18
Spring Spring Security Security versions 7.0.x antérieures à 7.0.6
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 2.7.x antérieures à 2.7.20
Spring Spring Data MongoDB Data MongoDB versions 4.3.x antérieures à 4.3.17
Spring Spring Security Security versions 1.5.x antérieures à 1.5.8
Spring Spring Security Security versions 6.3.x antérieures à 6.3.17
Spring Spring Data MongoDB Data MongoDB versions 4.5.x antérieures à 4.5.12
Spring Data REST Data REST versions 3.7.x antérieures à 3.7.20
Spring Data REST Data REST versions 4.5.x antérieures à 4.5.12
Spring Data REST Data REST versions 5.0.x antérieures à 5.0.6
Spring Spring Data Relational Data Relational versions 3.5.x antérieures à 3.5.12
Spring Spring AMQP AMQP versions 3.1.x antérieures à 3.1.16
Spring Spring Data Relational Data Relational versions 2.4.x antérieures à 2.4.20
Spring Data REST Data REST versions 4.4.x antérieures à 4.4.15
Spring Spring Security Security versions 5.7.x antérieures à 5.7.24
Spring Spring Data KeyValue Data KeyValue versions 4.0.x antérieures à 4.0.6
Spring Spring Data MongoDB Data MongoDB versions 4.4.x antérieures à 4.4.15
Spring Spring Data KeyValue Data KeyValue versions 2.7.x antérieures à 2.7.20
Spring Spring Security Security versions 6.5.x antérieures à 6.5.11
Spring Spring Data MongoDB Data MongoDB versions 5.0.x antérieures à 5.0.6
Spring Spring AMQP AMQP versions 3.2.x antérieures à 3.2.11
Spring Spring Security Security versions 6.4.x antérieures à 6.4.17
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.4.x antérieures à 3.4.15
Spring Spring Security Security versions 5.8.x antérieures à 5.8.26
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Data KeyValue versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 3.4.x ant\u00e9rieures \u00e0 3.4.20",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 4.0.3.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 3.2.10.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 2.4.x ant\u00e9rieures \u00e0 2.4.18",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 1.5.x ant\u00e9rieures \u00e0 1.5.8",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.3.x ant\u00e9rieures \u00e0 6.3.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 3.7.x ant\u00e9rieures \u00e0 3.7.20",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.1.x ant\u00e9rieures \u00e0 3.1.16",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 2.4.x ant\u00e9rieures \u00e0 2.4.20",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.7.x ant\u00e9rieures \u00e0 5.7.24",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.11",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.2.x ant\u00e9rieures \u00e0 3.2.11",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.8.x ant\u00e9rieures \u00e0 5.8.26",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
    },
    {
      "name": "CVE-2026-40993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40993"
    },
    {
      "name": "CVE-2026-41717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41717"
    },
    {
      "name": "CVE-2026-41721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
    },
    {
      "name": "CVE-2026-41695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
    },
    {
      "name": "CVE-2026-41729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41729"
    },
    {
      "name": "CVE-2026-41719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41719"
    },
    {
      "name": "CVE-2026-41697",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41697"
    },
    {
      "name": "CVE-2026-41008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41008"
    },
    {
      "name": "CVE-2026-41694",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
    },
    {
      "name": "CVE-2026-41696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41696"
    },
    {
      "name": "CVE-2026-41711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
    },
    {
      "name": "CVE-2026-40988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
    },
    {
      "name": "CVE-2026-41003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41003"
    },
    {
      "name": "CVE-2026-41701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41701"
    }
  ],
  "initial_release_date": "2026-06-10T00:00:00",
  "last_revision_date": "2026-06-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0719",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41003",
      "url": "https://spring.io/security/cve-2026-41003"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41696",
      "url": "https://spring.io/security/cve-2026-41696"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41697",
      "url": "https://spring.io/security/cve-2026-41697"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41716",
      "url": "https://spring.io/security/cve-2026-41716"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41721",
      "url": "https://spring.io/security/cve-2026-41721"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41695",
      "url": "https://spring.io/security/cve-2026-41695"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41694",
      "url": "https://spring.io/security/cve-2026-41694"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41711",
      "url": "https://spring.io/security/cve-2026-41711"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41008",
      "url": "https://spring.io/security/cve-2026-41008"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41729",
      "url": "https://spring.io/security/cve-2026-41729"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41701",
      "url": "https://spring.io/security/cve-2026-41701"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40993",
      "url": "https://spring.io/security/cve-2026-40993"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41719",
      "url": "https://spring.io/security/cve-2026-41719"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40988",
      "url": "https://spring.io/security/cve-2026-40988"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41717",
      "url": "https://spring.io/security/cve-2026-41717"
    }
  ]
}

CVE-2026-41719 (GCVE-0-2026-41719)

Vulnerability from cvelistv5 – Published: 2026-06-09 23:48 – Updated: 2026-06-10 12:54
VLAI
Title
Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
Summary
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data KeyValue Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.7.0 , < 2.7.20 (custom)
Create a notification for this product.
Spring Spring Data Redis Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.7.0 , < 2.7.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T12:54:23.195850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T12:54:36.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data KeyValue",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data Redis",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
            }
          ],
          "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply unsanitized Sort input to a Spring Data KeyValue repository method using SpelPropertyComparator can inject arbitrary SpEL expressions."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:48:42.396Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41719"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41719",
    "datePublished": "2026-06-09T23:48:42.396Z",
    "dateReserved": "2026-04-22T06:21:37.021Z",
    "dateUpdated": "2026-06-10T12:54:36.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}