CVE-2026-41697
Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
- Record
CVE-2026-41697- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-943
- Updated
- 2026-11-02
EUVDEUVD-2026-35893
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
- Record
EUVD-2026-35893- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8r2h-xh92-gq57
Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
- Record
GHSA-8r2h-xh92-gq57- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-943
- Updated
- 2026-11-02
NVD
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
- Record
CVE-2026-41697- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-943
- Updated
- 2026-11-02
OSV
Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
- Record
CVE-2026-41697- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-943
- Updated
- 2026-11-02
OSVGHSA-8r2h-xh92-gq57
Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
- Record
GHSA-8r2h-xh92-gq57- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-943
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1791381930 No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 3.3.13-tuxcare.6.
- Record
CLSA-2026-1791381930- Updated
- 2026-11-02
OSVCLSA-2026-1791983363 No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 3.4.13-tuxcare.4.
- Record
CLSA-2026-1791983363- Updated
- 2026-11-02
OSVCLSA-2026-1792429184 No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 3.3.12-tuxcare.3.
- Record
CLSA-2026-1792429184- Updated
- 2026-11-02
OSVCLSA-2026-1793194299 No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 2 org.springframework.data packages to address 1 CVE. Fixed in 2.4.18-tuxcare.6.
- Record
CLSA-2026-1793194299- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-relationalMaven |
4.0.0 to 4.0.5 | 4.0.6 |
org.springframework.data:spring-data-relationalMaven |
3.5.0 to 3.5.11 | 3.5.12 |
org.springframework.data:spring-data-relationalMaven |
3.4.0 to 3.4.14 | None known |
org.springframework.data:spring-data-relationalMaven |
3.0.0 to 3.3.16 | None known |
org.springframework.data:spring-data-relationalMaven |
through 2.4.19 | None known |
org.springframework.data:spring-data-jdbcTuxCare:Maven |
3.3.13 up to 3.3.13-tuxcare.6, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.33.3.13-tuxcare.43.3.13-tuxcare.5 |
3.3.13-tuxcare.6 |
org.springframework.data:spring-data-r2dbcTuxCare:Maven |
3.3.13 up to 3.3.13-tuxcare.6, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.33.3.13-tuxcare.43.3.13-tuxcare.5 |
3.3.13-tuxcare.6 |
org.springframework.data:spring-data-relationalTuxCare:Maven |
3.3.13 up to 3.3.13-tuxcare.6, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.33.3.13-tuxcare.43.3.13-tuxcare.5 |
3.3.13-tuxcare.6 |
org.springframework.data:spring-data-jdbcTuxCare:Maven |
3.4.13 up to 3.4.13-tuxcare.4, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.23.4.13-tuxcare.3 |
3.4.13-tuxcare.4 |
org.springframework.data:spring-data-r2dbcTuxCare:Maven |
3.4.13 up to 3.4.13-tuxcare.4, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.23.4.13-tuxcare.3 |
3.4.13-tuxcare.4 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-relationalTuxCare:Maven |
3.4.13 up to 3.4.13-tuxcare.4, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.23.4.13-tuxcare.3 |
3.4.13-tuxcare.4 |
org.springframework.data:spring-data-jdbcTuxCare:Maven |
3.3.12 up to 3.3.12-tuxcare.3, plus listed versions 3.3.12-tuxcare.13.3.12-tuxcare.2 |
3.3.12-tuxcare.3 |
org.springframework.data:spring-data-r2dbcTuxCare:Maven |
3.3.12 up to 3.3.12-tuxcare.3, plus listed versions 3.3.12-tuxcare.13.3.12-tuxcare.2 |
3.3.12-tuxcare.3 |
org.springframework.data:spring-data-relationalTuxCare:Maven |
3.3.12 up to 3.3.12-tuxcare.3, plus listed versions 3.3.12-tuxcare.13.3.12-tuxcare.2 |
3.3.12-tuxcare.3 |
org.springframework.data:spring-data-jdbcTuxCare:Maven |
2.4.18 up to 2.4.18-tuxcare.6, plus listed versions 2.4.18-tuxcare.12.4.18-tuxcare.22.4.18-tuxcare.32.4.18-tuxcare.42.4.18-tuxcare.5 |
2.4.18-tuxcare.6 |
org.springframework.data:spring-data-relationalTuxCare:Maven |
2.4.18 up to 2.4.18-tuxcare.6, plus listed versions 2.4.18-tuxcare.12.4.18-tuxcare.22.4.18-tuxcare.32.4.18-tuxcare.42.4.18-tuxcare.5 |
2.4.18-tuxcare.6 |
org.springframework.data:spring-data-relationalMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
org.springframework.data:spring-data-relationalMaven |
3.5.0 up to 3.5.12, plus listed versions 3.5.13.5.103.5.113.5.23.5.3 Show 6 moreShow less3.5.43.5.53.5.63.5.73.5.83.5.9 |
3.5.12 |
org.springframework.data:spring-data-relationalMaven |
3.4.0 to 3.4.14, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 |
None known |
org.springframework.data:spring-data-relationalMaven |
3.0.0 to 3.3.16, plus listed versions 3.0.13.0.103.0.113.0.123.0.2 Show 45 moreShow less3.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.7 |
None known |
org.springframework.data:spring-data-relationalMaven |
through 2.4.19, plus listed versions 1.1.0.RELEASE1.1.1.RELEASE1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE Show 45 moreShow less1.1.13.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE2.0.9.RELEASE2.1.02.1.12.1.102.1.112.1.122.1.132.1.142.1.152.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41697 is a medium vulnerability (CVSS 4.8) in Broadcom Spring Data Relational, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in org.springframework.data:spring-data-relational 4.0.6.
References
spring.io/security/cve-2026-41697
nvd.nist.gov/vuln/detail/CVE-2026-41697
github.com/spring-projects/spring-data-relational/releases/tag/3.5.12
Left out here: 35 versions. The JSON record has them.