com.ecfront.dew:cluster-spi-redis (1.2.2-rc), com.ecfront.dew:test-starter (1.2.2-rc) +45 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.6.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.ecfront.dew:cluster-spi-redis 1.2.2-rc -...

be.ordina:microservices-dashboard-server (1.0.1), cn.m1c.lannie:m1c-lannie-common (>=1.0.0-release, <=1.0.6.6-release) +21 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - be.ordina:microservices-dashboard-server 1.0.1 -...

org.springframework.data:spring-data-redis (1.7.0.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.0.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.7.0.release Sour...

com.aerospike:spring-data-aerospike (>=1.0.2.release, <=1.1.1.release), com.aerospike:spring-session-aerospike (1.0.0.release) +38 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.1.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.aerospike:spring-data-aerospike =1.0.2.release, =1.1.0,...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +455 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

com.genxiaogu:rate-limiter-spring-boot-starter (>=1.0.0, <=2.0.1), com.github.qiujiayu:autoload-cache-spring-boot-starter (>=1.1.0, <=6.6) +10 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.5.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.genxiaogu:rate-limiter-spring-boot-starter =1.0.0, =1.1.0...

com.cjoop:platform-core (0.0.1.release), com.cjoop:platform-security (0.0.1.release) +91 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.cjoop:platform-core 0.0.1.release -...

cn.sylinx:redis-spring-boot-starter (>=1.0.1, <=1.0.2), com.17jee:e-cache-hibernate-redis (>=3.0.1.9, <=3.0.1.11) +12 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.6.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.sylinx:redis-spring-boot-starter =1.0.1, =3.0.1.9, =3.0.1....

com.gitee.song666:upic-spring-common (1.0.0), com.github.bohrqiu.dubbo:dubbo-cache-core (>=1.0, <=1.2) +50 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.13.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.gitee.song666:upic-spring-common 1.0.0 -...

com.github.skyding228:spring-session-redis (1.0), net.mingsoft:ms-base (>=1.0.3, <=1.0.8) +14 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.10.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.skyding228:spring-session-redis 1.0 -...

cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +820 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: GHSA-XG2J-3HJ6-PC24...

cn.dyaoming.common:common-cache (0.0.2), cn.ocoop.framework:shiro-spring-boot-autoconfigure (1.0.1) +42 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.dyaoming.common:common-cache 0.0.2 -...

com.nepxion:aquarius-cache-redis (>=2.0.4, <=2.0.5), com.nepxion:aquarius-cache-starter (>=2.0.4, <=2.0.5) +12 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.16.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.nepxion:aquarius-cache-redis =2.0.4, =2.0.4, =2.0.4,...

org.springframework.boot:spring-boot-starter-data-redis (1.5.5.release), org.springframework.data:spring-data-redis (1.8.5.release) +1 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.5.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.boot:spring-boot-starter-data-redis...

cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39), cn.jiangzeyin:common-redis (>=1.0.0, <=1.0.3) +15 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.jiangzeyin.fast-boot:common-redis =1.0.3, =1.0.0, =0.0.1,...

cn.ibaijia:jsm-frame (1.3.24), com.gitee.fufu669:cache-fetch-later (>=6.6.667, <=6.666.66021) +15 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.7.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.ibaijia:jsm-frame 1.3.24 -...

org.springframework.boot:spring-boot-starter-data-redis (1.4.4.release), org.springframework.boot:spring-boot-starter-redis (1.4.4.release) +2 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.7.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.boot:spring-boot-starter-data-redis...

com.github.fangyanpg:spring-boot-ratelimiter (>=0.0.1-release, <=0.3.0-release), com.github.yihukurama:tkmybatisplus (0.0.2-release) +10 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.22.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.fangyanpg:spring-boot-ratelimiter =0.0.1-release,...

cn.net.vidyo:jsmth-data (3.3.120.release), com.github.vencent-lu:giants-cache-redis (>=1.0.4, <=1.0.5-beta-7) +4 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release -...

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...