CVE-2026-41697mediumCWE-943

Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.8epss 0.2%

probabilidad de explotación

0.2%top 86% de las CVE

explotación observada

noninguna fuente lo reporta

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Productos afectados

Spring · Spring Data JDBC Spring · Spring Data R2DBC Spring · Spring Data Relational

Referencias

https://spring.io/security/cve-2026-41697