CVE-2026-41719 vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

CVE-2026-41719

A flaw was found in Spring Data KeyValue. This vulnerability, known as a Spring Expression Language SpEL Injection, allows a remote attacker with low privileges to execute arbitrary expressions. This occurs when unsanitized user input is passed as a sorting parameter into a repository query metho...

com.chaoxing:redis-distribute-lock-spring-boot-starter (1.0.0), com.codingapi:sds-delivery (2.0.2) +45 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.10.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.chaoxing:redis-distribute-lock-spring-boot-starter 1.0.0...

cn.hankchan:utils (1.0.0), cn.ps1:aolai (>=0.0.1, <=1.0.0) +8 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.1.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.hankchan:utils 1.0.0 - cn.ps1:aolai =0.0.1, =0.0.2,...

cn.dyaoming.common:common-cache (0.0.2), cn.ocoop.framework:shiro-spring-boot-autoconfigure (1.0.1) +42 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.dyaoming.common:common-cache 0.0.2 -...

com.cjoop:platform-core (0.0.1.release), com.cjoop:platform-security (0.0.1.release) +91 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.cjoop:platform-core 0.0.1.release -...

ai.hyacinth.framework:core-service-cache-support (>=0.5.0, <=0.5.5), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.24) +5020 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=2.0.0.release, <=2.7.18)

org.springframework.data:spring-data-keyvalue MAVEN version =2.0.0.release, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =2.0.1.release, =1.1.0.release, =1.0.3.release, =1.0.0, =1.0.6, =0.5.0, =0.1.0, =0.3.0, =0.5.0, =0.8.0 and more Source cves: CVE-2026-41719 Source advisory:...

com.basicfu:system (1.0.0), com.github.andy-shao:gearee-redis (0.0.1.release) +51 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.8.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.basicfu:system 1.0.0 - com.github.andy-shao:gearee-redis...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +455 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

be.ordina:microservices-dashboard-server (1.0.1), cn.m1c.lannie:m1c-lannie-common (>=1.0.0-release, <=1.0.6.6-release) +21 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - be.ordina:microservices-dashboard-server 1.0.1 -...

cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39), cn.jiangzeyin:common-redis (>=1.0.0, <=1.0.3) +15 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.jiangzeyin.fast-boot:common-redis =1.0.3, =1.0.0, =0.0.1,...

com.github.surpassm:liaoin-security-app (0.0.1.release), com.github.surpassm:liaoin-security-core (0.0.1.release) +11 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.14.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.surpassm:liaoin-security-app 0.0.1.release -...

org.springframework.data:spring-data-redis (1.7.0.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.0.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.7.0.release Sour...

com.aerospike:spring-data-aerospike (>=1.0.2.release, <=1.1.1.release), com.aerospike:spring-session-aerospike (1.0.0.release) +38 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.1.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.aerospike:spring-data-aerospike =1.0.2.release, =1.1.0,...

cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +820 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: OSV:GHSA-XG2J-3HJ6-PC24...

org.springframework.data:spring-data-redis (1.8.2.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.8.2.release Sour...

cc.ereach:ereach-boot-starter-lock (1.0.1), cc.ereach:ereach-permission (1.0.1) +1666 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-redis (>=2.7.0, <=2.7.18)

org.springframework.data:spring-data-redis MAVEN version =2.7.0, =1.0, =1.10.0, =1.6.0, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - cc.zhaoac:faith-permission 1.1.0 and more Source cves: CVE-2026-41719 Source advisory: MEND:CVE-2026-41719...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +1038 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-keyvalue MAVEN version =3.5.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.3 - cc.uncarbon.framework:helio-starter-rate-limit-redis 2.5.0 - cc.uncarbon.framework:helio-starter-redis 2.5...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +441 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-redis (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-redis MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory: MEND:CVE-2026-41719...

CVE-2026-41719 Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...