Zip Slip Path Traversal

org.springframework.data, spring-data-geode is vulnerable to a Zip Slip Path Traversal. The vulnerability is due to improper validation of file paths during ZIP archive extraction, which allows an attacker to craft a malicious archive containing traversal paths and write files outside the intende...

SQL Injection

Spring Data Relational is vulnerable to SQL Injection. The vulnerability is due to insufficient escaping of wildcard characters in user-controlled input, which allows an attacker to inject wildcard patterns and perform boolean-based blind data inference...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to specially crafted HTTP requests causing excessive memory allocation when Spring Data Web Support is enabled with a controller method using @ProjectedPayload...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to a StackOverflowException when parsing attacker-controlled Sort parameters, allowing an attacker to exhaust application resources...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

Denial Of Service (DoS)

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to attacker-supplied strings being permanently retained as internal property-lookup cache keys, allowing repeated requests to exhaust application heap memory...

K000162894: Spring Data Relational vulnerability CVE-2026-41697

Security Advisory Description Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference...

CLSA-2026-1786547094 TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CLSA-2026-1786536841 TuxCare security update for org.springframework.data (3 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CLSA-2026-1782089830 TuxCare security update for org.springframework.data:spring-data-redis (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-redis to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1782089808 TuxCare security update for org.springframework.data:spring-data-keyvalue (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1782089825 TuxCare security update for org.springframework.data:spring-data-jpa (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-jpa to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1781830582 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1781830552 TuxCare security update for org.springframework.data:spring-data-r2dbc (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 1 CVE. Fixed in 1.5.18-tuxcare.2...

CLSA-2026-1781484835 TuxCare security update for org.springframework.data:spring-data-ldap (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 2 CVEs. Fixed in 2.7.18-tuxcare.3...

CLSA-2026-1781657701 TuxCare security update for org.springframework.data (1 CVE)

TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 3.7.18-tuxcare.2...

CLSA-2025-1754872136 TuxCare security update for org.springframework.data:spring-data-r2dbc (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 2 CVEs. Fixed in 1.5.18-tuxcare.1...

SpEL Expression Injection

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests. The vulnerability is due to the JSON Pointer path segment used as the map key being embedded directly into a SpEL expression without sanitization or validation, where...

Sensitive Information Exposure

Spring Data REST is vulnerable to Sensitive Information Exposure. The vulnerability is due to serialization of the full exception cause chain in HTTP error responses, allowing attackers to obtain persistence-layer implementation details and other internal application information through error...