CLEANSTART-2026-UW65052 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

PT-2026-132594

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.7.16-tuxcare.3...

CLEANSTART-2026-GV33004 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

PT-2026-117764

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

CLEANSTART-2026-BI57203 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

CLSA-2026-1789285402 TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.3.13-tuxcare.5...

CLSA-2026-1788422148 TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

CLSA-2026-1788200476 TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.3...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

CLSA-2026-1782089808 TuxCare security update for org.springframework.data:spring-data-keyvalue (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CVE-2026-41719

A flaw was found in Spring Data KeyValue. This vulnerability, known as a Spring Expression Language SpEL Injection, allows a remote attacker with low privileges to execute arbitrary expressions. This occurs when unsanitized user input is passed as a sorting parameter into a repository query metho...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +465 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

be.ordina:microservices-dashboard-server (1.0.1), cn.m1c.lannie:m1c-lannie-common (>=1.0.0-release, <=1.0.6.6-release) +21 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - be.ordina:microservices-dashboard-server 1.0.1 -...

cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39), cn.jiangzeyin:common-redis (>=1.0.0, <=1.0.3) +15 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.jiangzeyin.fast-boot:common-redis =1.0.3, =1.0.0, =0.0.1,...

com.aerospike:spring-data-aerospike (>=1.0.2.release, <=1.1.1.release), com.aerospike:spring-session-aerospike (1.0.0.release) +38 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.1.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.aerospike:spring-data-aerospike =1.0.2.release, =1.1.0,...

org.springframework.boot:spring-boot-starter-data-redis (1.5.5.release), org.springframework.data:spring-data-redis (1.8.5.release) +1 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.5.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.boot:spring-boot-starter-data-redis...

com.gitee.song666:upic-spring-common (1.0.0), com.github.bohrqiu.dubbo:dubbo-cache-core (>=1.0, <=1.2) +50 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.13.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.gitee.song666:upic-spring-common 1.0.0 -...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +1039 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-keyvalue MAVEN version =3.5.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.3 - cc.uncarbon.framework:helio-starter-rate-limit-redis 2.5.0 - cc.uncarbon.framework:helio-starter-redis 2.5...

cn.dyaoming.common:common-cache (0.0.2), cn.ocoop.framework:shiro-spring-boot-autoconfigure (1.0.1) +42 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.dyaoming.common:common-cache 0.0.2 -...

org.springframework.data:spring-data-redis (1.8.21.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.21.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.8.21.release...