Home

Description

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

PUBLISHED Reserved 2026-04-22 | Published 2026-06-09 | Updated 2026-06-10 | Assigner vmware




HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)

Product status

Default status
unaffected

5.0.0 (custom) before 5.0.6
affected

4.5.0 (custom) before 4.5.12
affected

4.4.0 (custom) before 4.4.15
affected

4.3.0 (custom) before 4.3.17
affected

4.2.0 (custom) before 4.2.16
affected

4.1.0 (custom) before 4.1.15
affected

4.0.0 (custom) before 4.0.16
affected

3.4.0 (custom) before 3.4.20
affected

References

spring.io/security/cve-2026-41717

cve.org (CVE-2026-41717)

nvd.nist.gov (CVE-2026-41717)

Download JSON