CVE-2026-41696
Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
- Record
CVE-2026-41696- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
EUVDEUVD-2026-35892
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
- Record
EUVD-2026-35892- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hc43-m36c-8v33
Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
- Record
GHSA-hc43-m36c-8v33- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
NVD
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
- Record
CVE-2026-41696- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
OSV
Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
- Record
CVE-2026-41696- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
OSVGHSA-hc43-m36c-8v33
Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
- Record
GHSA-hc43-m36c-8v33- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-943
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1788446203 No score
TuxCare security update for org.springframework.data (2 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 3.4.18-tuxcare.8.
- Record
CLSA-2026-1788446203- Updated
- 2026-11-02
OSVCLSA-2026-1789582244 No score
TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.3.12-tuxcare.1.
- Record
CLSA-2026-1789582244- Updated
- 2026-11-02
OSVCLSA-2026-1790002143 No score
TuxCare security update for org.springframework.data:spring-data-mongodb (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 2 CVEs. Fixed in 4.4.13-tuxcare.3.
- Record
CLSA-2026-1790002143- Updated
- 2026-11-02
OSVCLSA-2026-1791290050 No score
TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.3.13-tuxcare.6.
- Record
CLSA-2026-1791290050- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-mongodbMaven |
5.0.0 to 5.0.5 | 5.0.6 |
org.springframework.data:spring-data-mongodbMaven |
4.5.0 to 4.5.11 | 4.5.12 |
org.springframework.data:spring-data-mongodbMaven |
4.4.0 to 4.4.14 | None known |
org.springframework.data:spring-data-mongodbMaven |
4.0.0 to 4.3.16 | None known |
org.springframework.data:spring-data-mongodbMaven |
through 3.4.19 | None known |
org.springframework.data:spring-data-mongodbTuxCare:Maven |
4.3.12 up to 4.3.12-tuxcare.1 | 4.3.12-tuxcare.1 |
org.springframework.data:spring-data-mongodbTuxCare:Maven |
4.4.13 up to 4.4.13-tuxcare.3, plus listed versions 4.4.13-tuxcare.14.4.13-tuxcare.2 |
4.4.13-tuxcare.3 |
org.springframework.data:spring-data-mongodbTuxCare:Maven |
4.3.13 up to 4.3.13-tuxcare.6, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.34.3.13-tuxcare.44.3.13-tuxcare.5 |
4.3.13-tuxcare.6 |
org.springframework.data:spring-data-mongodbMaven |
5.0.0 up to 5.0.6, plus listed versions 5.0.15.0.25.0.35.0.45.0.5 |
5.0.6 |
org.springframework.data:spring-data-mongodbMaven |
4.5.0 up to 4.5.12, plus listed versions 4.5.14.5.104.5.114.5.24.5.3 Show 6 moreShow less4.5.44.5.54.5.64.5.74.5.84.5.9 |
4.5.12 |
org.springframework.data:spring-data-mongodbMaven |
4.4.0 to 4.4.14, plus listed versions 4.4.14.4.104.4.114.4.124.4.13 Show 8 moreShow less4.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9 |
None known |
org.springframework.data:spring-data-mongodbMaven |
4.0.0 to 4.3.16, plus listed versions 4.0.14.0.104.0.114.0.124.0.2 Show 45 moreShow less4.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.04.2.14.2.104.2.114.2.124.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.94.3.04.3.14.3.104.3.114.3.124.3.134.3.24.3.34.3.44.3.54.3.64.3.7 |
None known |
org.springframework.data:spring-data-mongodbMaven |
through 3.4.19, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE Show 45 moreShow less1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.10.0.RELEASE1.10.1.RELEASE1.10.10.RELEASE1.10.11.RELEASE1.10.12.RELEASE1.10.13.RELEASE1.10.14.RELEASE1.10.15.RELEASE1.10.16.RELEASE1.10.17.RELEASE1.10.18.RELEASE1.10.2.RELEASE1.10.20.RELEASE1.10.21.RELEASE1.10.22.RELEASE1.10.23.RELEASE1.10.3.RELEASE1.10.4.RELEASE1.10.5.RELEASE1.10.6.RELEASE1.10.7.RELEASE1.10.8.RELEASE1.10.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.4.RELEASE |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41696 is a medium vulnerability (CVSS 5.9) in Spring Data Mongodb, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in org.springframework.data:spring-data-mongodb 5.0.6.
References
spring.io/security/cve-2026-41696
nvd.nist.gov/vuln/detail/CVE-2026-41696
github.com/spring-projects/spring-data-mongodb/issues/5205
Left out here: 150 versions. The JSON record has them.