Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

3 vulnerabilities found for Spring Data Relational by Spring

CVE-2026-41697 (GCVE-0-2026-41697)

Vulnerability from nvd – Published: 2026-06-09 23:47 – Updated: 2026-06-09 23:47
VLAI
Title
Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Summary
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE
  • CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data Relational Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.4.0 , < 2.4.20 (custom)
Create a notification for this product.
Spring Spring Data JDBC Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.4.0 , < 2.4.20 (custom)
Create a notification for this product.
Spring Spring Data R2DBC Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 1.5.0 , < 1.5.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data Relational",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.4.20",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data JDBC",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.4.20",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data R2DBC",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.20",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.\n\nAffected versions:\nSpring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19."
            }
          ],
          "value": "Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.\n\nAffected versions:\nSpring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply wildcard characters to a Query By Example probe can perform boolean-based blind data inference against the queried entity."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:47:42.091Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41697"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41697",
    "datePublished": "2026-06-09T23:47:42.091Z",
    "dateReserved": "2026-04-22T06:21:22.981Z",
    "dateUpdated": "2026-06-09T23:47:42.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-0719

Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Spring Data KeyValue Data KeyValue versions 3.3.x antérieures à 3.3.17
Spring Data REST Data REST versions 4.3.x antérieures à 4.3.17
Spring Spring Data KeyValue Data KeyValue versions 3.4.x antérieures à 3.4.15
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.5.x antérieures à 3.5.12
Spring Spring Data Relational Data Relational versions 3.4.x antérieures à 3.4.15
Spring Spring AMQP AMQP versions 4.0.x antérieures à 4.0.4
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 4.0.x antérieures à 4.0.6
Spring Spring Data MongoDB Data MongoDB versions 3.4.x antérieures à 3.4.20
Spring Spring AMQP AMQP versions antérieures à 4.0.3.1
Spring Spring AMQP AMQP versions antérieures à 3.2.10.1
Spring Spring Data Relational Data Relational versions 3.3.x antérieures à 3.3.17
Spring Spring Data Relational Data Relational versions 4.0.x antérieures à 4.0.6
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.3.x antérieures à 3.3.17
Spring Spring Data KeyValue Data KeyValue versions 3.5.x antérieures à 3.5.12
Spring Spring AMQP AMQP versions 2.4.x antérieures à 2.4.18
Spring Spring Security Security versions 7.0.x antérieures à 7.0.6
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 2.7.x antérieures à 2.7.20
Spring Spring Data MongoDB Data MongoDB versions 4.3.x antérieures à 4.3.17
Spring Spring Security Security versions 1.5.x antérieures à 1.5.8
Spring Spring Security Security versions 6.3.x antérieures à 6.3.17
Spring Spring Data MongoDB Data MongoDB versions 4.5.x antérieures à 4.5.12
Spring Data REST Data REST versions 3.7.x antérieures à 3.7.20
Spring Data REST Data REST versions 4.5.x antérieures à 4.5.12
Spring Data REST Data REST versions 5.0.x antérieures à 5.0.6
Spring Spring Data Relational Data Relational versions 3.5.x antérieures à 3.5.12
Spring Spring AMQP AMQP versions 3.1.x antérieures à 3.1.16
Spring Spring Data Relational Data Relational versions 2.4.x antérieures à 2.4.20
Spring Data REST Data REST versions 4.4.x antérieures à 4.4.15
Spring Spring Security Security versions 5.7.x antérieures à 5.7.24
Spring Spring Data KeyValue Data KeyValue versions 4.0.x antérieures à 4.0.6
Spring Spring Data MongoDB Data MongoDB versions 4.4.x antérieures à 4.4.15
Spring Spring Data KeyValue Data KeyValue versions 2.7.x antérieures à 2.7.20
Spring Spring Security Security versions 6.5.x antérieures à 6.5.11
Spring Spring Data MongoDB Data MongoDB versions 5.0.x antérieures à 5.0.6
Spring Spring AMQP AMQP versions 3.2.x antérieures à 3.2.11
Spring Spring Security Security versions 6.4.x antérieures à 6.4.17
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.4.x antérieures à 3.4.15
Spring Spring Security Security versions 5.8.x antérieures à 5.8.26
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Data KeyValue versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 3.4.x ant\u00e9rieures \u00e0 3.4.20",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 4.0.3.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 3.2.10.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 2.4.x ant\u00e9rieures \u00e0 2.4.18",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 1.5.x ant\u00e9rieures \u00e0 1.5.8",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.3.x ant\u00e9rieures \u00e0 6.3.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 3.7.x ant\u00e9rieures \u00e0 3.7.20",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.1.x ant\u00e9rieures \u00e0 3.1.16",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 2.4.x ant\u00e9rieures \u00e0 2.4.20",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.7.x ant\u00e9rieures \u00e0 5.7.24",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.11",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.2.x ant\u00e9rieures \u00e0 3.2.11",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.8.x ant\u00e9rieures \u00e0 5.8.26",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
    },
    {
      "name": "CVE-2026-40993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40993"
    },
    {
      "name": "CVE-2026-41717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41717"
    },
    {
      "name": "CVE-2026-41721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
    },
    {
      "name": "CVE-2026-41695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
    },
    {
      "name": "CVE-2026-41729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41729"
    },
    {
      "name": "CVE-2026-41719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41719"
    },
    {
      "name": "CVE-2026-41697",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41697"
    },
    {
      "name": "CVE-2026-41008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41008"
    },
    {
      "name": "CVE-2026-41694",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
    },
    {
      "name": "CVE-2026-41696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41696"
    },
    {
      "name": "CVE-2026-41711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
    },
    {
      "name": "CVE-2026-40988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
    },
    {
      "name": "CVE-2026-41003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41003"
    },
    {
      "name": "CVE-2026-41701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41701"
    }
  ],
  "initial_release_date": "2026-06-10T00:00:00",
  "last_revision_date": "2026-06-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0719",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41003",
      "url": "https://spring.io/security/cve-2026-41003"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41696",
      "url": "https://spring.io/security/cve-2026-41696"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41697",
      "url": "https://spring.io/security/cve-2026-41697"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41716",
      "url": "https://spring.io/security/cve-2026-41716"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41721",
      "url": "https://spring.io/security/cve-2026-41721"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41695",
      "url": "https://spring.io/security/cve-2026-41695"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41694",
      "url": "https://spring.io/security/cve-2026-41694"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41711",
      "url": "https://spring.io/security/cve-2026-41711"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41008",
      "url": "https://spring.io/security/cve-2026-41008"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41729",
      "url": "https://spring.io/security/cve-2026-41729"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41701",
      "url": "https://spring.io/security/cve-2026-41701"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40993",
      "url": "https://spring.io/security/cve-2026-40993"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41719",
      "url": "https://spring.io/security/cve-2026-41719"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40988",
      "url": "https://spring.io/security/cve-2026-40988"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41717",
      "url": "https://spring.io/security/cve-2026-41717"
    }
  ]
}

CVE-2026-41697 (GCVE-0-2026-41697)

Vulnerability from cvelistv5 – Published: 2026-06-09 23:47 – Updated: 2026-06-09 23:47
VLAI
Title
Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Summary
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE
  • CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data Relational Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.4.0 , < 2.4.20 (custom)
Create a notification for this product.
Spring Spring Data JDBC Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 2.4.0 , < 2.4.20 (custom)
Create a notification for this product.
Spring Spring Data R2DBC Affected: 4.0.0 , < 4.0.6 (custom)
Affected: 3.5.0 , < 3.5.12 (custom)
Affected: 3.4.0 , < 3.4.15 (custom)
Affected: 3.3.0 , < 3.3.17 (custom)
Affected: 3.2.0 , < 3.2.16 (custom)
Affected: 3.1.0 , < 3.1.15 (custom)
Affected: 3.0.0 , < 3.0.16 (custom)
Affected: 1.5.0 , < 1.5.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data Relational",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.4.20",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data JDBC",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.4.20",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data R2DBC",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.20",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.\n\nAffected versions:\nSpring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19."
            }
          ],
          "value": "Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.\n\nAffected versions:\nSpring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply wildcard characters to a Query By Example probe can perform boolean-based blind data inference against the queried entity."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:47:42.091Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41697"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41697",
    "datePublished": "2026-06-09T23:47:42.091Z",
    "dateReserved": "2026-04-22T06:21:22.981Z",
    "dateUpdated": "2026-06-09T23:47:42.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}