SQL Injection

Spring Data Relational is vulnerable to SQL Injection. The vulnerability is due to insufficient escaping of wildcard characters in user-controlled input, which allows an attacker to inject wildcard patterns and perform boolean-based blind data inference...

K000162894: Spring Data Relational vulnerability CVE-2026-41697

Security Advisory Description Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational [CVE-2026-41697]

Summary IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational, due to a failure to properly escape binding values of externally-controlled input hat can allow an attacker can supply wildcard characters CVE-2026-41697. Spring Data Relational, is used as par...

CVE-2026-41697

A flaw was found in Spring Data Relational. This vulnerability allows a remote attacker to perform boolean-based blind data inference by supplying wildcard characters in externally-controlled input when using StringMatcher in Query By Example QBE. This can lead to the disclosure of sensitive...

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

com.ethlo.keyvalue:keyvalue-mysql (>=1.0.0, <=1.1.2), org.springframework.boot:spring-boot-starter-data-jdbc (2.2.0.release) +1 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.0.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.ethlo.keyvalue:keyvalue-mysql =1.0.0, =1.1.2 -...

org.springframework.data:spring-data-jdbc (1.1.2.release) potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.2.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - org.springframework.data:spring-data-jdbc 1.1.2.release...

com.foilen:database-tools (0.4.4), org.nhind:config-service-jar (>=7.0, <=7.0.1) +3 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.4.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.foilen:database-tools 0.4.4 -...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), ai.ylyue:yue-library-data-jdbc (>=j8.2.2.0, <=j11.2.2.0) +11 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.5.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - ai.ylyue:yue-library-data-es =j8.2.2.0, =j8.2.2.0,...

com.github.jchanghong:test (2.2.6), com.github.jchanghong:utils (2.2.6) +2 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.6.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.github.jchanghong:test 2.2.6 -...

cn.fxbin.bubble:bubble-fireworks-data-mybatis (0.0.3-release), cn.fxbin.bubble:bubble-fireworks-starter-mybatis (0.0.3-release) +2 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.8.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.fxbin.bubble:bubble-fireworks-data-mybatis 0.0.3-relea...

ai.ylyue:yue-library-data-es (>=j8.2.3.0, <=j11.2.6.1), ai.ylyue:yue-library-data-jdbc (>=j8.2.3.0, <=j11.2.6.1) +531 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=2.0.0.release, <=2.4.18)

org.springframework.data:spring-data-relational MAVEN version =2.0.0.release, =j8.2.3.0, =j8.2.3.0, =0.0.1-alpha, =0.0.2-alpha, =2.5.0, =1.0.1, =2.4.5, =1.0.9, =0.0.1, =1.0.0.release, =0.1.8.jre11, =1.0.0, =1.0.0, =4.0.462, =4.0.551 and more Source cves: CVE-2026-41697 Source advisory:...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +669 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-relational MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: GHSA-8R2H-XH92-GQ57...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +669 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-relational MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: OSV:GHSA-8R2H-XH92-GQ57...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +482 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: GHSA-8R2H-XH92-GQ57...

br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +455 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.0.0, <=3.3.13)

org.springframework.data:spring-data-relational MAVEN version =3.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-41697 Source advisory: OSV:GHSA-8R2H-XH92-GQ57...

com.infobip:infobip-spring-data-jdbc-querydsl (3.0.0), org.springframework.boot:spring-boot-starter-data-jdbc (2.2.1.release) +1 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.1.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.infobip:infobip-spring-data-jdbc-querydsl 3.0.0 -...

cn.cenxt:cenxt-task-scheduler-core (>=0.0.1, <=1.0.5), com.github.jchanghong:parent (>=3.0.11, <=3.0.19) +6 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.3.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.cenxt:cenxt-task-scheduler-core =0.0.1, =3.0.11,...

cn.guomw.cloud:framework-cloud-starter-web (>=1.0.0.release, <=1.1.0.1.btxc.release), org.nhind:config-service-jar (7.0.2) +3 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.9.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.guomw.cloud:framework-cloud-starter-web =1.0.0.release...

org.springframework.boot:spring-boot-starter-data-jdbc (>=2.2.12.release, <=2.2.13.release), org.springframework.data:spring-data-jdbc (1.1.12.release) potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.12.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - org.springframework.boot:spring-boot-starter-data-jdbc...