Every CVE Search/ Get API key

CVE-2026-41719

Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

6.4 MediumFix available

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

0.21%Up 0.2 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.4

Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Record
CVE-2026-41719
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-917
Updated
2026-11-02
EUVDEUVD-2026-35901 6.4

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Record
EUVD-2026-35901
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-xg2j-3hj6-pc24 6.4

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Record
GHSA-xg2j-3hj6-pc24
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-917
Updated
2026-11-02
NVD 6.4

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Record
CVE-2026-41719
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-917
Updated
2026-11-02
OSV 6.4

Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Record
CVE-2026-41719
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-917
Updated
2026-11-05
OSVGHSA-xg2j-3hj6-pc24 6.4

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Record
GHSA-xg2j-3hj6-pc24
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-917
Updated
2026-11-02
Show 13 moreShow less
OSVCLSA-2026-1791467859 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.3.13-tuxcare.6.

Record
CLSA-2026-1791467859
Updated
2026-11-02
OSVCLSA-2026-1791979377 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.7.18-tuxcare.9.

Record
CLSA-2026-1791979377
Updated
2026-11-02
OSVCLSA-2026-1792421347 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.7.16-tuxcare.3.

Record
CLSA-2026-1792421347
Updated
2026-11-02
OSVCLSA-2026-1792427749 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.3.12-tuxcare.3.

Record
CLSA-2026-1792427749
Updated
2026-11-02
OSVCLSA-2026-1792490239 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.4.9-tuxcare.3.

Record
CLSA-2026-1792490239
Updated
2026-11-02
OSVCLSA-2026-1792491026 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.6.10-tuxcare.3.

Record
CLSA-2026-1792491026
Updated
2026-11-02
OSVCLSA-2026-1792657708 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.5.12-tuxcare.2.

Record
CLSA-2026-1792657708
Updated
2026-11-02
OSVCLSA-2026-1792660304 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.1.8-tuxcare.3.

Record
CLSA-2026-1792660304
Updated
2026-11-02
OSVCLSA-2026-1792661279 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.4.8-tuxcare.2.

Record
CLSA-2026-1792661279
Updated
2026-11-02
OSVCLSA-2026-1792666371 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.0.12-tuxcare.2.

Record
CLSA-2026-1792666371
Updated
2026-11-02
OSVCLSA-2026-1793184702 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.2.12-tuxcare.3.

Record
CLSA-2026-1793184702
Updated
2026-11-02
OSVCLSA-2026-1793201948 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.3.5.RELEASE-tuxcare.1.

Record
CLSA-2026-1793201948
Updated
2026-11-02
OSVCLSA-2026-1793969873 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 1.2.23.RELEASE-tuxcare.1.

Record
CLSA-2026-1793969873
Updated
2026-11-06

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.springframework.data:spring-data-keyvalue
Maven
 4.0.0 to 4.0.5
4.0.6
org.springframework.data:spring-data-keyvalue
Maven
 3.5.0 to 3.5.11
3.5.12
org.springframework.data:spring-data-keyvalue
Maven
 3.4.0 to 3.4.14 None known
org.springframework.data:spring-data-keyvalue
Maven
 3.0.0 to 3.3.16 None known
org.springframework.data:spring-data-keyvalue
Maven
 through 2.7.19 None known
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 3.3.13 up to 3.3.13-tuxcare.6, plus listed versions
3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.33.3.13-tuxcare.43.3.13-tuxcare.5
3.3.13-tuxcare.6
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.7.18 up to 2.7.18-tuxcare.9, plus listed versions
2.7.18-tuxcare.22.7.18-tuxcare.32.7.18-tuxcare.42.7.18-tuxcare.52.7.18-tuxcare.6
Show 4 moreShow less
2.7.18-tuxcare.72.7.18-tuxcare.82.7.18.tuxcare2.7.18.tuxcare.1
2.7.18-tuxcare.9
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.7.16 up to 2.7.16-tuxcare.3, plus listed versions
2.7.16-tuxcare.12.7.16-tuxcare.2
2.7.16-tuxcare.3
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 3.3.12 up to 3.3.12-tuxcare.3, plus listed versions
3.3.12-tuxcare.13.3.12-tuxcare.2
3.3.12-tuxcare.3
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.4.9 up to 2.4.9-tuxcare.3, plus listed versions
2.4.9-tuxcare.12.4.9-tuxcare.2
2.4.9-tuxcare.3
Show 13 moreShow less
Affected packages
PackageAffectedFixed
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.6.10 up to 2.6.10-tuxcare.3, plus listed versions
2.6.10-tuxcare.12.6.10-tuxcare.2
2.6.10-tuxcare.3
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.5.12 up to 2.5.12-tuxcare.2, plus listed versions
2.5.12-tuxcare.1
2.5.12-tuxcare.2
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 3.1.8 up to 3.1.8-tuxcare.3, plus listed versions
3.1.8-tuxcare.13.1.8-tuxcare.2
3.1.8-tuxcare.3
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.4.8 up to 2.4.8-tuxcare.2, plus listed versions
2.4.8-tuxcare.1
2.4.8-tuxcare.2
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 3.0.12 up to 3.0.12-tuxcare.2, plus listed versions
3.0.12-tuxcare.1
3.0.12-tuxcare.2
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 3.2.12 up to 3.2.12-tuxcare.3, plus listed versions
3.2.12-tuxcare.13.2.12-tuxcare.2
3.2.12-tuxcare.3
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 2.3.5.RELEASE up to 2.3.5.RELEASE-tuxcare.1
2.3.5.RELEASE-tuxcare.1
org.springframework.data:spring-data-keyvalue
TuxCare:Maven
 1.2.23.RELEASE up to 1.2.23.RELEASE-tuxcare.1
1.2.23.RELEASE-tuxcare.1
org.springframework.data:spring-data-keyvalue
Maven
 4.0.0 up to 4.0.6, plus listed versions
4.0.14.0.24.0.34.0.44.0.5
4.0.6
org.springframework.data:spring-data-keyvalue
Maven
 3.5.0 up to 3.5.12, plus listed versions
3.5.13.5.103.5.113.5.23.5.3
Show 6 moreShow less
3.5.43.5.53.5.63.5.73.5.83.5.9
3.5.12
org.springframework.data:spring-data-keyvalue
Maven
 3.4.0 to 3.4.14, plus listed versions
3.4.13.4.103.4.113.4.123.4.13
Show 8 moreShow less
3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9
 None known
org.springframework.data:spring-data-keyvalue
Maven
 3.0.0 to 3.3.16, plus listed versions
3.0.13.0.103.0.113.0.123.0.2
Show 45 moreShow less
3.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.7
 None known
org.springframework.data:spring-data-keyvalue
Maven
 through 2.7.19, plus listed versions
1.0.0.RELEASE1.0.1.RELEASE1.0.5.RELEASE1.0.6.RELEASE1.1.0.RELEASE
Show 45 moreShow less
1.1.1.RELEASE1.1.10.RELEASE1.1.11.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.10.RELEASE1.2.11.RELEASE1.2.12.RELEASE1.2.13.RELEASE1.2.14.RELEASE1.2.15.RELEASE1.2.16.RELEASE1.2.17.RELEASE1.2.18.RELEASE1.2.2.RELEASE1.2.20.RELEASE1.2.21.RELEASE1.2.22.RELEASE1.2.23.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.2.9.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.10.RELEASE2.0.11.RELEASE2.0.12.RELEASE2.0.13.RELEASE2.0.14.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE
 None known

History

History
RecordedChangedSources
affected, aliasesOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41719 is a medium vulnerability (CVSS 6.4) in Broadcom Spring Data Keyvalue, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in org.springframework.data:spring-data-keyvalue 4.0.6.

References

This page doesn't list everything

Left out here: 111 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open