CVE-2026-41697

Katalog CVE

CVSS 4.8 · Medium EPSS 0,29%

Kerentanan Improper Neutralization of Special Elements in Data Query Logic pada broadcom spring data relational. Skor CVSS 3.1 4.8 (Medium) menurut vmware.com.

Deskripsi (NVD)

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

Rincian

Terbit di NVD

10 Juni 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber vmware.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-41697 advisory vendor