Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-41697— Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Quick assessment

Affected

Spring Spring Data Relational

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VMware Spring Data Relational是美国威睿（VMware）公司的一个关系型数据库访问框架。 VMware Spring Data Relational存在安全漏洞，该漏洞源于在Query By Example中使用StringMatcher时未正确转义外部控制输入的绑定值，攻击者可提供通配符字符进行基于布尔的盲数据推断。以下版本受到影响：4.0.0至4.0.5版本、3.5.0至3.5.11版本、3.4.0至3.4.14版本、3.3.0至3.3.16版本、3.2.0至3.2.15版

CVSS 4.8 · Medium EPSS 0.23% · P14 Updated Jul 02, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1110.001 · Password Guessing

Affected Version Matrix 24

Vendor	Product	Version Range	Status
Spring	Spring Data JDBC	`4.0.0< 4.0.5.1`	affected
		`3.5.0< 3.5.11.1`	affected
		`3.4.0< 3.4.15`	affected
		`3.3.0< 3.3.17`	affected
		`3.2.0< 3.2.16`	affected
		`3.1.0< 3.1.15`	affected
		`3.0.0< 3.0.16`	affected
		`2.4.0< 2.4.20`	affected
Spring	Spring Data R2DBC	`4.0.0< 4.0.5.1`	affected
		`3.5.0< 3.5.11.1`	affected
		`3.4.0< 3.4.15`	affected
		`3.3.0< 3.3.17`	affected
		`3.2.0< 3.2.16`	affected
		`3.1.0< 3.1.15`	affected
		`3.0.0< 3.0.16`	affected
		`1.5.0< 1.5.20`	affected
Spring	Spring Data Relational	`4.0.0< 4.0.5.1`	affected
		`3.5.0< 3.5.11.1`	affected
		`3.4.0< 3.4.15`	affected
		`3.3.0< 3.3.17`	affected
		`3.2.0< 3.2.16`	affected
		`3.1.0< 3.1.15`	affected
		`3.0.0< 3.0.16`	affected
		`2.4.0< 2.4.20`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-41697

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Source: CVE Program / CVE List V5

Vulnerability Description

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

数据查询逻辑中特殊元素的不当中和

Source: CVE Program / CVE List V5

Vulnerability Title

VMware Spring Data Relational 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Spring	Spring Data Relational	4.0.0 ~ 4.0.5.1	-
Spring	Spring Data JDBC	4.0.0 ~ 4.0.5.1	-
Spring	Spring Data R2DBC	4.0.0 ~ 4.0.5.1	-

II. Public POCs for CVE-2026-41697

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-41697

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-41697 (1)

🔗 CVE-2026-41697: Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern Read full article

https://www.cve.org/CVERecord?id=CVE-2026-41697

Same Patch Batch · Spring · 2026-06-09 · 51 CVEs total

CVE-2026-41731	8.1 HIGH	In Spring for Apache Kafka, overly broad trusted-package matching in header mappers expose
CVE-2026-41732	8.1 HIGH	In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper expose
CVE-2026-41729	8.1 HIGH	Spring Data REST SpEL Injection via Map Key in JSON Patch
CVE-2026-41855	8.1 HIGH	Spring Framework Unsafe Deserialization via Jackson JMS Converters
CVE-2026-41717	8.1 HIGH	Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
CVE-2026-41003	7.6 HIGH	Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
CVE-2026-41728	7.5 HIGH	Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objec
CVE-2026-41842	7.5 HIGH	Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
CVE-2026-41850	7.5 HIGH	Spring Framework Algorithmic Denial of Service via SpEL Expressions
CVE-2026-41007	7.5 HIGH	Spring HATEOAS heap exhaustion through unbounded internal caching
CVE-2026-41849	7.5 HIGH	Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
CVE-2026-40984	7.5 HIGH	Micrometer HTTP server instrumentations DoS vulnerability
CVE-2026-41695	7.5 HIGH	Denial of Service in Spring Data Commons Property Path Resolution
CVE-2026-41716	7.5 HIGH	Spring Data web support unbounded negative-result cache keyed on attacker-supplied propert
CVE-2026-40988	7.5 HIGH	Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
CVE-2026-40983	7.5 HIGH	Micrometer gRPC server instrumentation DoS vulnerability
CVE-2026-41006	7.5 HIGH	Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
CVE-2026-41720	7.4 HIGH	Authentication Bypass with Empty Password in Spring LDAP
CVE-2026-40993	7.3 HIGH	Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Databa
CVE-2026-41845	7.1 HIGH	Spring Framework Cross-site Scripting via JavaScriptUtils

Showing top 20 of 51 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Spring

Same weakness: CWE-943