Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41717Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
High 8.1
In plain English
A high-severity expression language injection in Spring Data MongoDB from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-mongodb | 5.0.6 | GHSA-5whc-4q84-fj73 |
| Maven | org.springframework.data:spring-data-mongodb | 4.5.12 | GHSA-5whc-4q84-fj73 |
| Maven | org.springframework.data:spring-data-mongodb | no fix listed | GHSA-5whc-4q84-fj73 |
| Maven | org.springframework.data:spring-data-mongodb | no fix listed | GHSA-5whc-4q84-fj73 |
| Maven | org.springframework.data:spring-data-mongodb | no fix listed | GHSA-5whc-4q84-fj73 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Data MongoDB | 5.0.0 – before 5.0.5.14.5.0 – before 4.5.11.14.4.0 – before 4.4.154.3.0 – before 4.3.174.2.0 – before 4.2.164.1.0 – before 4.1.154.0.0 – before 4.0.163.4.0 – before 3.4.20 |
Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H