GHSA-XG2J-3HJ6-PC24 Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

com.github.liuzhongkai:spider-boot-restdoc (>=2.3.0-release, <=2.3.1-release), com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.6, <=0.0.8) +10 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.liuzhongkai:spider-boot-restdoc =2.3.0-release,...

com.github.paulcwarren:spring-content-rest (>=0.0.1, <=0.0.2), com.github.paulcwarren:spring-content-rest-boot-starter (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:spring-content-rest =0.0.1, =0.0.1,...

org.springframework.data:spring-cql (1.5.2.release), org.springframework.data:spring-data-cassandra (1.5.2.release) +14 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.5.2.release -...

com.bq.corbel.lib:mongodb (>=0.7.0, <=0.9.1), com.bq.corbel.lib:queries (>=0.15.0, <=0.20.0) +212 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.9.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.bq.corbel.lib:mongodb =0.7.0, =0.15.0, =0.15.0, =0.15.0,...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +2 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.1.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

io.fabric8:process-spring-boot-itests-service-invoicing (>=1.2.0.beta2, <=1.2.0.beta3), org.springframework.boot:spring-boot-starter-data-rest (1.1.5.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.1.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-service-invoicing...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.data:spring-data-rest-hal-browser (2.6.21.release), org.springframework.data:spring-data-rest-webmvc (2.6.21.release) potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.21.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.data:spring-data-rest-hal-browser (2.6.21.release), org.springframework.data:spring-data-rest-webmvc (2.6.21.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.21.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

com.sap.research.security.vulas:rest-backend (>=3.1.6, <=3.1.15), org.sakaiproject.edu-services.gradebook:gradebook-service-impl (>=20.0, <=20.6) +6 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.23.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.sap.research.security.vulas:rest-backend =3.1.6, =20.0...

com.sap.research.security.vulas:rest-backend (>=3.1.6, <=3.1.15), org.sakaiproject.edu-services.gradebook:gradebook-service-impl (>=20.0, <=20.6) +6 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.23.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.sap.research.security.vulas:rest-backend =3.1.6, =20.0...

ai.apiverse:apipulse (1.0.1), app.commerce-io:spring-boot-starter-data-search-jpa (>=1.1.0-rc1, <=1.3.0) +385 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (>=3.0.0.release, <=3.7.18)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.release, =1.1.0-rc1, =1.0.1.release, =1.0.0.release, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0, =1.4.0, =1.6.0 - co.bittub.api:core 1.0.0 - com.9isuper.pelecanus:pelecanus-data-jpa 1.0.3.m1 -...

ai.apiverse:apipulse (1.0.1), app.commerce-io:spring-boot-starter-data-search-jpa (>=1.1.0-rc1, <=1.3.0) +385 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=3.0.0.release, <=3.7.18)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.release, =1.1.0-rc1, =1.0.1.release, =1.0.0.release, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0, =1.4.0, =1.6.0 - co.bittub.api:core 1.0.0 - com.9isuper.pelecanus:pelecanus-data-jpa 1.0.3.m1 -...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41730 Source advisory: OSV:GHSA-P5MM-XWGQ-WHFRhttps://vulners.c...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-RG79-863Chttps://vulners.com/g...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41837 Source advisory: OSV:GHSA-M...