Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-41719GHSA-XG2J-3HJ6-PC24

Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.0.5.1, 3.5.11.1, 3.4.15, 3.3.17, 3.2.16, and 5 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Spring Spring Data KeyValue

    From 4.0.0 · fixed in 4.0.5.1; From 3.5.0 · fixed in 3.5.11.1; From 3.4.0 · fixed in 3.4.15; From 3.3.0 · fixed in 3.3.17; From 3.2.0 · fixed in 3.2.16; From 3.1.0 · fixed in 3.1.15; From 3.0.0 · fixed in 3.0.16; From 2.7.0 · fixed in 2.7.20

  • Spring Spring Data Redis

    From 4.0.0 · fixed in 4.0.5.1; From 3.5.0 · fixed in 3.5.11.1; From 3.4.0 · fixed in 3.4.15; From 3.3.0 · fixed in 3.3.17; From 3.2.0 · fixed in 3.2.16; From 3.1.0 · fixed in 3.1.15; From 3.0.0 · fixed in 3.0.16; From 2.7.0 · fixed in 2.7.20

  • org.springframework.data:spring-data-keyvalueMaven

    From 4.0.0 · fixed in 4.0.6

  • org.springframework.data:spring-data-keyvalueMaven

    From 3.5.0 · fixed in 3.5.12

  • org.springframework.data:spring-data-keyvalueMaven

    From 3.4.0 · through 3.4.14

  • org.springframework.data:spring-data-keyvalueMaven

    From 3.0.0 · through 3.3.16

  • org.springframework.data:spring-data-keyvalueMaven

    through 2.7.19

References 1

spring.io