com.github.liaomengge:base-dubbo-framework (2.0.5-release), com.github.liaomengge:base-dubbo-framework-mapper (2.0.5-release) +23 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.liaomengge:base-dubbo-framework 2.0.5-release -...

CVE-2026-41717

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41717: Improper Neutralization of Special Elements used in an Expression Language Statement

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

PT-2026-75936

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

PT-2026-75974

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696: Improper Neutralization of Special Elements in Data Query Logic

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

VMware Spring Data MongoDB 安全漏洞

VMware Spring Data MongoDB is a MongoDB data access framework developed by the American company VMware. There is a security vulnerability in VMware Spring Data MongoDB, which stems from insufficient validation of bound parameters in repository query methods using the @Query annotation and regular...

CVE-2026-41717

Spring Data MongoDB contains a SpEL expression injection vulnerability in parameter binding for user-defined repository queries annotated with @Query using a capture-all placeholder. Affected versions include 5.0.0–5.0.5; 4.5.0–4.5.11; 4.4.0–4.4.14; 4.3.0–4.3.16; 4.2.0–4.2.15; 4.1.0–4.1.14; 4.0.0...

CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41717 Source advisory:...

CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

cn.airfei.air-core:core (>=3.0.0, <=3.0.4), cn.allbs:allbs-bom (>=1.1.6, <=2.0.0) +304 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=3.4.0, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.4.0, =3.0.0, =1.1.6, =1.1.6, =0.0.1, =0.0.5, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.3.0 - cn.bootx.platform:service-office 1.2.3 - cn.bootx.platform:service-visualization 1.2.3 and more Source cves:...

CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696

Spring Data MongoDB CVE-2026-41696 affects multiple versions (5.0.0–5.0.5; 4.5.0–4.5.11; 4.4.0–4.4.14; 4.3.0–4.3.16; 4.2.0–4.2.15; 4.1.0–4.1.14; 4.0.0–4.0.15; 3.4.0–3.4.19). The issue is insufficient validation of bound parameters in repository query methods annotated with @Query that use regex b...

cn.airfei.air-core:core (>=3.0.0, <=3.0.4), cn.allbs:allbs-bom (>=1.1.6, <=2.0.0) +304 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=3.4.0, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.4.0, =3.0.0, =1.1.6, =1.1.6, =0.0.1, =0.0.5, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.3.0 - cn.bootx.platform:service-office 1.2.3 - cn.bootx.platform:service-visualization 1.2.3 and more Source cves:...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the @Query regex parameter binding when a bound parameter is placed inside a regular expression literal using \Q...\E quoting e.g. @Query" name : /^\\Q?0\\E$/ "...