Spring Data Mongodb vulnerabilities
2 known vulnerabilities affecting spring/spring_data_mongodb.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2026-41717P3HIGHCVSS 8.1≥ 5.0.0, < 5.0.5.1≥ 4.5.0, < 4.5.11.1+6 more2026-06-10
CVE-2026-41717 [HIGH] CWE-917 CVE-2026-41717: Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability.
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.
Affected versions:
Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.
nvd
CVE-2026-41696P3MEDIUMCVSS 5.9≥ 5.0.0, < 5.0.6≥ 4.5.0, < 4.5.12+6 more2026-06-10
CVE-2026-41696 [MEDIUM] CWE-943 CVE-2026-41696: Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions:
Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.
nvd