GHSA-HC43-M36C-8V33 Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...

org.inigma.shared:inigma-shared (0.1), org.springframework.data:spring-data-mongodb-cross-store (1.0.4.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.inigma.shared:inigma-shared 0.1 -...

org.inigma.shared:inigma-mongo (>=0.6.1, <=0.10.0), org.springframework.data:spring-data-mongodb-cross-store (1.1.2.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.inigma.shared:inigma-mongo =0.6.1, =0.10.0 -...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +15 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.23.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0, =3.10.0,...

at.rodrigo.api.gateway:api-gateway-entity (1.3.2), com.9isuper.pelecanus:pelecanus-data-mongodb (1.0.3.m1) +48 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - at.rodrigo.api.gateway:api-gateway-entity 1.3.2 -...

com.github.kancyframework:delay-message-data-mongodb (0.0.1-release), de.adorsys.multibanking:multibanking-persistence-mongodb (>=5.4.2, <=5.5.23) +9 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.kancyframework:delay-message-data-mongodb...

org.springframework.data:spring-data-mongodb-cross-store (1.9.0.release), uk.ac.ebi.ddi:ddi-service-db (>=1.0, <=1.15.2) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.9.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.ozwillo.datacore:ozwillo-datacore-core (1.10.1), org.springframework.boot:spring-boot-starter-data-mongodb (1.1.5.release) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 -...

com.capitalone.dashboard:core (0.4.1), com.sangupta:jerry-services (0.3.0) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.6.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:core 0.4.1 - com.sangupta:jerry-servic...

org.springframework.data:spring-data-mongodb-cross-store (1.3.4.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.3.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.bushidowallet:bushido-service-lib (>=1.0.0, <=1.0.3), com.github.camel-labs:camel-labs-iot-cloudlet-document-driver (0.1.0) +23 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.6.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.bushidowallet:bushido-service-lib =1.0.0, =0.5.17, =1.14,...

org.springframework.data:spring-data-mongodb-cross-store (1.7.0.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.7.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.alibaba.smart.framework:smart-engine-extension-storage-mongodb (>=2.0.4, <=2.6.4), org.springframework.boot:spring-boot-starter-data-mongodb (1.4.7.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.9.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

de.digitalcollections:iiif-bookshelf-webapp (>=2.3.1, <=2.5.1), io.gumga:gumga-application (>=1.5.23, <=4.0.4) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.digitalcollections:iiif-bookshelf-webapp =2.3.1, =1.5.23,...

com.epam.reportportal:commons-bugtracking (>=4.0.0, <=4.0.4), com.sinsz.c:bxfs-mongodb (1.0.1) +10 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-bugtracking =4.0.0, =1.2, =2.6.0...

com.airlenet:play-repo-mongo (2.0.0), com.bol:spring-data-mongodb-encrypt (>=1.0, <=1.3.0) +190 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.airlenet:play-repo-mongo 2.0.0 -...

com.github.mikeqian:sales-common (1.1.13), com.sangupta:urn (0.1.0) +11 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.8.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.8.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.mikeqian:sales-common 1.1.13 - com.sangupta:urn 0.1....

org.springframework.data:spring-data-mongodb-cross-store (1.3.1.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.3.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.avides.springboot.springtainer:springtainer-mongodb (1.0.0), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (1.0.0-rc2) +19 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.avides.springboot.springtainer:springtainer-mongodb 1.0.0 -...