← Back

CVE-2026-41697

nvd nist
Published: Jun 10, 2026Modified: Sep 4, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Exploitability: 2.2 / Impact: 2.5
Source: security@vmware.com (Secondary)

Description

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

Affected (5)

Broadcom
1 product
Spring Data Relational
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Broadcom
Spring Data Relational
Before 2.4.20
Spring Data Relational
From 3.0.0 to 3.3.17
Spring Data Relational
From 3.4.0 to 3.4.15
Spring Data Relational
From 3.5.0 to 3.5.11.1
Spring Data Relational
From 4.0.0 to 4.0.5.1

Related CWEs

CWE-943
Improper Neutralization of Special Elements in Data Query Logic
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.