CVE-2026-41697CWE-943

CVE-2026-41697

Medium · published June 10, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.

Affected versions:

Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.9th percentile
Weakness
CWE-943 · Improper Neutralization of Special Elements in Data Query Logic
Published
2026-06-10T04:16Z
Affected products (5)
ProductVersionsFixed in
broadcom/spring_data_relational< 2.4.202.4.20
broadcom/spring_data_relational≥ 3.0.0, < 3.3.173.3.17
broadcom/spring_data_relational≥ 3.4.0, < 3.4.153.4.15
broadcom/spring_data_relational≥ 3.5.0, < 3.5.11.13.5.11.1
broadcom/spring_data_relational≥ 4.0.0, < 4.0.5.14.0.5.1
References (1)
https://spring.io/security/cve-2026-41697 · [email protected]
EPSS history
Timeline
  • 09 JUN 23:47Z
    Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
    cvelistv5