Search

Find a vulnerability

Search criteria

    3 vulnerabilities found for Spring Data KeyValue by Spring

    CVE-2026-41719 (GCVE-0-2026-41719)

    Vulnerability from nvd – Published: 2026-06-09 23:48 – Updated: 2026-06-10 12:54
    VLAI
    Title
    Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
    Summary
    A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Spring Spring Data KeyValue Affected: 4.0.0 , < 4.0.6 (custom)
    Affected: 3.5.0 , < 3.5.12 (custom)
    Affected: 3.4.0 , < 3.4.15 (custom)
    Affected: 3.3.0 , < 3.3.17 (custom)
    Affected: 3.2.0 , < 3.2.16 (custom)
    Affected: 3.1.0 , < 3.1.15 (custom)
    Affected: 3.0.0 , < 3.0.16 (custom)
    Affected: 2.7.0 , < 2.7.20 (custom)
    		Create a notification for this product.
    Spring Spring Data Redis Affected: 4.0.0 , < 4.0.6 (custom)
    Affected: 3.5.0 , < 3.5.12 (custom)
    Affected: 3.4.0 , < 3.4.15 (custom)
    Affected: 3.3.0 , < 3.3.17 (custom)
    Affected: 3.2.0 , < 3.2.16 (custom)
    Affected: 3.1.0 , < 3.1.15 (custom)
    Affected: 3.0.0 , < 3.0.16 (custom)
    Affected: 2.7.0 , < 2.7.20 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T12:54:23.195850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T12:54:36.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data KeyValue",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data Redis",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
            }
          ],
          "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply unsanitized Sort input to a Spring Data KeyValue repository method using SpelPropertyComparator can inject arbitrary SpEL expressions."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:48:42.396Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41719"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41719",
    "datePublished": "2026-06-09T23:48:42.396Z",
    "dateReserved": "2026-04-22T06:21:37.021Z",
    "dateUpdated": "2026-06-10T12:54:36.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CERTFR-2026-AVI-0719

    Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

    De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et un déni de service.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Spring Spring Data KeyValue Data KeyValue versions 3.3.x antérieures à 3.3.17
    Spring Data REST Data REST versions 4.3.x antérieures à 4.3.17
    Spring Spring Data KeyValue Data KeyValue versions 3.4.x antérieures à 3.4.15
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.5.x antérieures à 3.5.12
    Spring Spring Data Relational Data Relational versions 3.4.x antérieures à 3.4.15
    Spring Spring AMQP AMQP versions 4.0.x antérieures à 4.0.4
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 4.0.x antérieures à 4.0.6
    Spring Spring Data MongoDB Data MongoDB versions 3.4.x antérieures à 3.4.20
    Spring Spring AMQP AMQP versions antérieures à 4.0.3.1
    Spring Spring AMQP AMQP versions antérieures à 3.2.10.1
    Spring Spring Data Relational Data Relational versions 3.3.x antérieures à 3.3.17
    Spring Spring Data Relational Data Relational versions 4.0.x antérieures à 4.0.6
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.3.x antérieures à 3.3.17
    Spring Spring Data KeyValue Data KeyValue versions 3.5.x antérieures à 3.5.12
    Spring Spring AMQP AMQP versions 2.4.x antérieures à 2.4.18
    Spring Spring Security Security versions 7.0.x antérieures à 7.0.6
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 2.7.x antérieures à 2.7.20
    Spring Spring Data MongoDB Data MongoDB versions 4.3.x antérieures à 4.3.17
    Spring Spring Security Security versions 1.5.x antérieures à 1.5.8
    Spring Spring Security Security versions 6.3.x antérieures à 6.3.17
    Spring Spring Data MongoDB Data MongoDB versions 4.5.x antérieures à 4.5.12
    Spring Data REST Data REST versions 3.7.x antérieures à 3.7.20
    Spring Data REST Data REST versions 4.5.x antérieures à 4.5.12
    Spring Data REST Data REST versions 5.0.x antérieures à 5.0.6
    Spring Spring Data Relational Data Relational versions 3.5.x antérieures à 3.5.12
    Spring Spring AMQP AMQP versions 3.1.x antérieures à 3.1.16
    Spring Spring Data Relational Data Relational versions 2.4.x antérieures à 2.4.20
    Spring Data REST Data REST versions 4.4.x antérieures à 4.4.15
    Spring Spring Security Security versions 5.7.x antérieures à 5.7.24
    Spring Spring Data KeyValue Data KeyValue versions 4.0.x antérieures à 4.0.6
    Spring Spring Data MongoDB Data MongoDB versions 4.4.x antérieures à 4.4.15
    Spring Spring Data KeyValue Data KeyValue versions 2.7.x antérieures à 2.7.20
    Spring Spring Security Security versions 6.5.x antérieures à 6.5.11
    Spring Spring Data MongoDB Data MongoDB versions 5.0.x antérieures à 5.0.6
    Spring Spring AMQP AMQP versions 3.2.x antérieures à 3.2.11
    Spring Spring Security Security versions 6.4.x antérieures à 6.4.17
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.4.x antérieures à 3.4.15
    Spring Spring Security Security versions 5.8.x antérieures à 5.8.26
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Data KeyValue versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 3.4.x ant\u00e9rieures \u00e0 3.4.20",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 4.0.3.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 3.2.10.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 2.4.x ant\u00e9rieures \u00e0 2.4.18",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 1.5.x ant\u00e9rieures \u00e0 1.5.8",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.3.x ant\u00e9rieures \u00e0 6.3.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 3.7.x ant\u00e9rieures \u00e0 3.7.20",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.1.x ant\u00e9rieures \u00e0 3.1.16",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 2.4.x ant\u00e9rieures \u00e0 2.4.20",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.7.x ant\u00e9rieures \u00e0 5.7.24",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.11",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.2.x ant\u00e9rieures \u00e0 3.2.11",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.8.x ant\u00e9rieures \u00e0 5.8.26",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
    },
    {
      "name": "CVE-2026-40993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40993"
    },
    {
      "name": "CVE-2026-41717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41717"
    },
    {
      "name": "CVE-2026-41721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
    },
    {
      "name": "CVE-2026-41695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
    },
    {
      "name": "CVE-2026-41729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41729"
    },
    {
      "name": "CVE-2026-41719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41719"
    },
    {
      "name": "CVE-2026-41697",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41697"
    },
    {
      "name": "CVE-2026-41008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41008"
    },
    {
      "name": "CVE-2026-41694",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
    },
    {
      "name": "CVE-2026-41696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41696"
    },
    {
      "name": "CVE-2026-41711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
    },
    {
      "name": "CVE-2026-40988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
    },
    {
      "name": "CVE-2026-41003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41003"
    },
    {
      "name": "CVE-2026-41701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41701"
    }
  ],
  "initial_release_date": "2026-06-10T00:00:00",
  "last_revision_date": "2026-06-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0719",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41003",
      "url": "https://spring.io/security/cve-2026-41003"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41696",
      "url": "https://spring.io/security/cve-2026-41696"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41697",
      "url": "https://spring.io/security/cve-2026-41697"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41716",
      "url": "https://spring.io/security/cve-2026-41716"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41721",
      "url": "https://spring.io/security/cve-2026-41721"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41695",
      "url": "https://spring.io/security/cve-2026-41695"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41694",
      "url": "https://spring.io/security/cve-2026-41694"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41711",
      "url": "https://spring.io/security/cve-2026-41711"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41008",
      "url": "https://spring.io/security/cve-2026-41008"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41729",
      "url": "https://spring.io/security/cve-2026-41729"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41701",
      "url": "https://spring.io/security/cve-2026-41701"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40993",
      "url": "https://spring.io/security/cve-2026-40993"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41719",
      "url": "https://spring.io/security/cve-2026-41719"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40988",
      "url": "https://spring.io/security/cve-2026-40988"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41717",
      "url": "https://spring.io/security/cve-2026-41717"
    }
  ]
}

    CVE-2026-41719 (GCVE-0-2026-41719)

    Vulnerability from cvelistv5 – Published: 2026-06-09 23:48 – Updated: 2026-06-10 12:54
    VLAI
    Title
    Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
    Summary
    A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Spring Spring Data KeyValue Affected: 4.0.0 , < 4.0.6 (custom)
    Affected: 3.5.0 , < 3.5.12 (custom)
    Affected: 3.4.0 , < 3.4.15 (custom)
    Affected: 3.3.0 , < 3.3.17 (custom)
    Affected: 3.2.0 , < 3.2.16 (custom)
    Affected: 3.1.0 , < 3.1.15 (custom)
    Affected: 3.0.0 , < 3.0.16 (custom)
    Affected: 2.7.0 , < 2.7.20 (custom)
    		Create a notification for this product.
    Spring Spring Data Redis Affected: 4.0.0 , < 4.0.6 (custom)
    Affected: 3.5.0 , < 3.5.12 (custom)
    Affected: 3.4.0 , < 3.4.15 (custom)
    Affected: 3.3.0 , < 3.3.17 (custom)
    Affected: 3.2.0 , < 3.2.16 (custom)
    Affected: 3.1.0 , < 3.1.15 (custom)
    Affected: 3.0.0 , < 3.0.16 (custom)
    Affected: 2.7.0 , < 2.7.20 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T12:54:23.195850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T12:54:36.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data KeyValue",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data Redis",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.12",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.15",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.17",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.15",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.16",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.20",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
            }
          ],
          "value": "A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.\n\nAffected versions:\nSpring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply unsanitized Sort input to a Spring Data KeyValue repository method using SpelPropertyComparator can inject arbitrary SpEL expressions."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:48:42.396Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41719"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41719",
    "datePublished": "2026-06-09T23:48:42.396Z",
    "dateReserved": "2026-04-22T06:21:37.021Z",
    "dateUpdated": "2026-06-10T12:54:36.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}