{"id":"CVE-2026-47834","aliases":["CLSA-2026-1791470326","CLSA-2026-1791984118","CLSA-2026-1791984420","CLSA-2026-1792429273","CLSA-2026-1792662923","CLSA-2026-1792668848","CLSA-2026-1793187929","EUVD-2026-66676","GHSA-77gf-pv2q-2p9p"],"status":"published","title":"Spring Data JPA Sort expression validation bypass","description":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.\nSpring Data JPA 4.1.0\nSpring Data JPA 4.0.0 - 4.0.6\nSpring Data JPA 3.5.0 - 3.5.13\nSpring Data JPA 3.0.0 - 3.4.15","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0034,"percentile":0.27624,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-26T19:22:22Z","modified":"2026-11-02T19:46:32Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","fixed_in":["3.3.13-tuxcare.7","3.5.13-tuxcare.3","3.4.13-tuxcare.4","3.3.12-tuxcare.3","3.1.8-tuxcare.3","3.0.12-tuxcare.2","3.2.12-tuxcare.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.13"},{"fixed":"3.3.13-tuxcare.7"}]}],"versions":["3.3.13","3.3.13-tuxcare.1","3.3.13-tuxcare.2","3.3.13-tuxcare.3","3.3.13-tuxcare.4","3.3.13-tuxcare.5","3.3.13-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.13"},{"fixed":"3.5.13-tuxcare.3"}]}],"versions":["3.5.13","3.5.13-tuxcare.1","3.5.13-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.4"}]}],"versions":["3.4.13","3.4.13-tuxcare.1","3.4.13-tuxcare.2","3.4.13-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.12"},{"fixed":"3.3.12-tuxcare.3"}]}],"versions":["3.3.12","3.3.12-tuxcare.1","3.3.12-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.3"}]}],"versions":["3.1.8","3.1.8-tuxcare.1","3.1.8-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.2"}]}],"versions":["3.0.12","3.0.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.12"},{"fixed":"3.2.12-tuxcare.5"}]}],"versions":["3.2.12","3.2.12-tuxcare.1","3.2.12-tuxcare.2","3.2.12-tuxcare.3","3.2.12-tuxcare.4"]}],"products":[{"vendor":"spring","product":"spring data jpa"},{"vendor":"vmware","product":"spring_data_jpa"}],"references":[{"url":"https://spring.io/security/cve-2026-47834","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47834","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-77gf-pv2q-2p9p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47834.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47834","title":"Spring Data JPA Sort expression validation bypass","description":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.\nSpring Data JPA 4.1.0\nSpring Data JPA 4.0.0 - 4.0.6\nSpring Data JPA 3.5.0 - 3.5.13\nSpring Data JPA 3.0.0 - 3.4.15","status":"published","published":"2026-08-26T19:22:22.873Z","modified":"2026-08-26T19:45:40.524Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66676","description":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.\nSpring Data JPA 4.1.0\nSpring Data JPA 4.0.0 - 4.0.6\nSpring Data JPA 3.5.0 - 3.5.13\nSpring Data JPA 3.0.0 - 3.4.15","status":"published","published":"2026-08-26T19:22:22Z","modified":"2026-08-26T19:45:40Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-77gf-pv2q-2p9p","title":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are...","description":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.\nSpring Data JPA 4.1.0\nSpring Data JPA 4.0.0 - 4.0.6\nSpring Data JPA 3.5.0 - 3.5.13\nSpring Data JPA 3.0.0 - 3.4.15","status":"published","published":"2026-08-26T21:31:43Z","modified":"2026-08-26T21:31:47Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:11:01.362113Z"}],"nvd":[{"id":"CVE-2026-47834","description":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.\nSpring Data JPA 4.1.0\nSpring Data JPA 4.0.0 - 4.0.6\nSpring Data JPA 3.5.0 - 3.5.13\nSpring Data JPA 3.0.0 - 3.4.15","status":"published","published":"2026-08-26T20:17:24.043Z","modified":"2026-09-04T19:36:02.693Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-47834","title":"Spring Data JPA Sort expression validation bypass","description":"Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.\nSpring Data JPA 4.1.0\nSpring Data JPA 4.0.0 - 4.0.6\nSpring Data JPA 3.5.0 - 3.5.13\nSpring Data JPA 3.0.0 - 3.4.15","status":"published","published":"2026-08-26T19:22:22.873Z","modified":"2026-10-28T02:30:29.057929419Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1791470326","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.3.13-tuxcare.7.","status":"published","published":"2026-10-08T14:38:46Z","modified":"2026-11-02T19:46:26.878356495Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791984118","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.5.13-tuxcare.3.","status":"published","published":"2026-10-14T13:21:58Z","modified":"2026-11-02T19:46:27.774274609Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791984420","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.4.13-tuxcare.4.","status":"published","published":"2026-10-14T13:27:00Z","modified":"2026-11-02T19:46:27.747393312Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792429273","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.3.12-tuxcare.3.","status":"published","published":"2026-10-19T17:01:13Z","modified":"2026-11-02T19:46:29.65724508Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792662923","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.1.8-tuxcare.3.","status":"published","published":"2026-10-22T09:55:23Z","modified":"2026-11-02T19:46:30.625053456Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792668848","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.0.12-tuxcare.2.","status":"published","published":"2026-10-22T11:34:08Z","modified":"2026-11-02T19:46:30.450872571Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793187929","title":"TuxCare security update for org.springframework.data:spring-data-jpa (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-jpa to address 1 CVE. Fixed in 3.2.12-tuxcare.5.","status":"published","published":"2026-10-28T11:45:29Z","modified":"2026-11-02T19:46:32.851899642Z","updated_at":"2026-11-02T20:28:42.34712Z"}]}}