Description
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Problem types
Product status
5.0.0 (custom) before 5.0.6
4.5.0 (custom) before 4.5.12
4.4.0 (custom) before 4.4.15
4.3.0 (custom) before 4.3.17
4.2.0 (custom) before 4.2.16
4.1.0 (custom) before 4.1.15
4.0.0 (custom) before 4.0.16
3.4.0 (custom) before 3.4.20
References
spring.io/security/cve-2026-41717