Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41697Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Medium 4.8
In plain English
A medium-severity security flaw in Spring Data JDBC from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-relational | 4.0.6 | GHSA-8r2h-xh92-gq57 |
| Maven | org.springframework.data:spring-data-relational | 3.5.12 | GHSA-8r2h-xh92-gq57 |
| Maven | org.springframework.data:spring-data-relational | no fix listed | GHSA-8r2h-xh92-gq57 |
| Maven | org.springframework.data:spring-data-relational | no fix listed | GHSA-8r2h-xh92-gq57 |
| Maven | org.springframework.data:spring-data-relational | no fix listed | GHSA-8r2h-xh92-gq57 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Data Relational | 4.0.0 – before 4.0.5.13.5.0 – before 3.5.11.13.4.0 – before 3.4.153.3.0 – before 3.3.173.2.0 – before 3.2.163.1.0 – before 3.1.153.0.0 – before 3.0.162.4.0 – before 2.4.20 |
| Spring | Spring Data JDBC | 4.0.0 – before 4.0.5.13.5.0 – before 3.5.11.13.4.0 – before 3.4.153.3.0 – before 3.3.173.2.0 – before 3.2.163.1.0 – before 3.1.153.0.0 – before 3.0.162.4.0 – before 2.4.20 |
| Spring | Spring Data R2DBC | 4.0.0 – before 4.0.5.13.5.0 – before 3.5.11.13.4.0 – before 3.4.153.3.0 – before 3.3.173.2.0 – before 3.2.163.1.0 – before 3.1.153.0.0 – before 3.0.161.5.0 – before 1.5.20 |
Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L