CVE-2026-47834

CVE-2026-47834

Medium · published August 27, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.

Spring Data JPA 4.1.0

Spring Data JPA 4.0.0 - 4.0.6

Spring Data JPA 3.5.0 - 3.5.13

Spring Data JPA 3.0.0 - 3.4.15

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.2th percentile
Published
2026-08-27T00:17Z
Affected products (4)
ProductVersionsFixed in
vmware/spring_data_jpa≥ 3.0.0, < 3.4.163.4.16
vmware/spring_data_jpa≥ 3.5.0, < 3.5.143.5.14
vmware/spring_data_jpa≥ 4.0.0, < 4.0.6.14.0.6.1
vmware/spring_data_jpa≥ 4.1.0, < 4.1.0.14.1.0.1
References (1)
https://spring.io/security/cve-2026-47834 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 26 AUG 19:22Z
    Spring Data JPA Sort expression validation bypass
    cvelistv5