Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41696Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Medium 5.9
In plain English
A medium-severity security flaw in Spring Data MongoDB from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-mongodb | 5.0.6 | GHSA-hc43-m36c-8v33 |
| Maven | org.springframework.data:spring-data-mongodb | 4.5.12 | GHSA-hc43-m36c-8v33 |
| Maven | org.springframework.data:spring-data-mongodb | no fix listed | GHSA-hc43-m36c-8v33 |
| Maven | org.springframework.data:spring-data-mongodb | no fix listed | GHSA-hc43-m36c-8v33 |
| Maven | org.springframework.data:spring-data-mongodb | no fix listed | GHSA-hc43-m36c-8v33 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Data MongoDB | 5.0.0 – before 5.0.64.5.0 – before 4.5.124.4.0 – before 4.4.154.3.0 – before 4.3.174.2.0 – before 4.2.164.1.0 – before 4.1.154.0.0 – before 4.0.163.4.0 – before 3.4.20 |
Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N