CVE-2026-41697

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-41697	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:broadcom:spring_data_relational::::::::
	cpe:2.3:a:broadcom:spring_data_relational::::::::
	cpe:2.3:a:broadcom:spring_data_relational::::::::
	cpe:2.3:a:broadcom:spring_data_relational::::::::
	cpe:2.3:a:broadcom:spring_data_relational::::::::

History

No history.

Information

Published : 2026-06-10 00:16

Updated : 2026-09-04 19:18

NVD link : CVE-2026-41697

Mitre link : CVE-2026-41697

CVE.ORG link : CVE-2026-41697

JSON object : View

Products Affected

broadcom

spring_data_relational

CWE

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-41697", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41697", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T17:51:14.731749Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Data Relational", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.5.1", "versionType": "custom"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.11.1", "versionType": "custom"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.15", "versionType": "custom"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.17", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.16", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.15", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.16", "versionType": "custom"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.20", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Spring", "product": "Spring Data JDBC", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.5.1", "versionType": "custom"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.11.1", "versionType": "custom"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.15", "versionType": "custom"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.17", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.16", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.15", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.16", "versionType": "custom"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.20", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Spring", "product": "Spring Data R2DBC", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.5.1", "versionType": "custom"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.11.1", "versionType": "custom"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.15", "versionType": "custom"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.17", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.16", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.15", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.16", "versionType": "custom"}, {"status": "affected", "version": "1.5.0", "lessThan": "1.5.20", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-10T00:16:50.947", "references": [{"url": "https://spring.io/security/cve-2026-41697", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.\n\nAffected versions:\nSpring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19."}, {"lang": "es", "value": "Spring Data Relational no escapa correctamente los valores de enlace de entrada controlada externamente al usar StringMatcher (STARTING, ENDING o CONTAINING) en Query By Example (QBE). Un atacante puede proporcionar caracteres comod\u00edn para realizar inferencia de datos ciega basada en booleanos.\n\nVersiones afectadas:\nSpring Data Relational/JDBC/R2DBC 4.0.0 a 4.0.5; 3.5.0 a 3.5.11; 3.4.0 a 3.4.14; 3.3.0 a 3.3.16; 3.2.0 a 3.2.15; 3.1.0 a 3.1.14; 3.0.0 a 3.0.15; 2.4.0 a 2.4.19."}], "lastModified": "2026-09-04T19:18:46.493", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:spring_data_relational:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F017F5E-9EC3-439F-A43F-4113FAD09086", "versionEndExcluding": "2.4.20"}, {"criteria": "cpe:2.3:a:broadcom:spring_data_relational:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53D87733-3F0F-456F-AE32-37199893182F", "versionEndExcluding": "3.3.17", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_data_relational:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF18549A-DC11-4AD5-9A73-FDE6F9DB3F4B", "versionEndExcluding": "3.4.15", "versionStartIncluding": "3.4.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_data_relational:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B289749D-20C6-4E12-83FA-55642F036916", "versionEndExcluding": "3.5.11.1", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:broadcom:spring_data_relational:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DDB0B92-901A-4DAE-BBE3-56240D273655", "versionEndExcluding": "4.0.5.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}