CVE-2026-47834

A flaw was found in Spring Data JPA. This vulnerability allows a remote attacker to bypass data validation mechanisms by submitting specially crafted input. This could lead to unauthorized access to limited information and minor disruptions in service availability. Mitigation There is no mitigati...

Sort Validation Bypass

org.springframework.data, spring-data-jpa is vulnerable to a Sort validation bypass. The vulnerability is due to insufficient validation of crafted Sort parameters received from untrusted sources, which allows an attacker to bypass sorting validation and potentially inject malicious sorting...

CVE-2026-47834

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834

CVE-2026-47834 affects Spring Data JPA versions 4.1.0 , 4.0.0–4.0.6 , 3.5.0–3.5.13 , and 3.0.0–3.4.15 . The vulnerability allows bypass of Sort expression validation when crafted payloads are accepted from untrusted sources, potentially leading to low confidentiality and low availability impact. ...

EUVD-2026-66676

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

PT-2026-82245

Name of the Vulnerable Software and Affected Versions Spring Data JPA version 4.1.0 Spring Data JPA versions 4.0.0 through 4.0.6 Spring Data JPA versions 3.5.0 through 3.5.13 Spring Data JPA versions 3.0.0 through 3.4.15 Description Sort validation can be bypassed when parameters containing craft...

CVE-2026-47834: Undefined Security Weakness

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass

cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass...

SQL Injection

Overview org.springframework.data:spring-data-jpa is a package that is used to implement JPA based repositories. Affected versions of this package are vulnerable to SQL Injection in the validation of Sort parameters when crafted payloads are accepted from untrusted sources and used without prior...

CLSA-2026-1782089825 TuxCare security update for org.springframework.data:spring-data-jpa (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-jpa to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

com.sksamuel.elasticsearch:elasticsearch-river-neo4j (>=0.90.7.0, <=0.90.9.0), org.springframework.data:spring-cql (1.3.6.release) +15 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.11.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.sksamuel.elasticsearch:elasticsearch-river-neo4j =0.90.7.0...

org.springframework.data:spring-cql (1.5.2.release), org.springframework.data:spring-data-cassandra (1.5.2.release) +14 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.5.2.release -...

com.github.darrachequesne:spring-data-jpa-datatables (>=1.0, <=2.6), com.github.lodsve:lodsve-mongodb (>=2.4.8, <=2.5.10) +61 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.10.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.darrachequesne:spring-data-jpa-datatables =1.0,...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

org.springframework.data:spring-cql (1.4.9.release), org.springframework.data:spring-data-cassandra (1.4.9.release) +13 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.9.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.4.9.release -...

org.springframework.data:spring-cql (1.4.9.release), org.springframework.data:spring-data-cassandra (1.4.9.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.9.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.4.9.release -...