cn.dinodev:dinodev-spring-core (>=3.3.0, <=3.3.4), cn.dinodev:dinodev-spring-data (>=3.3.0, <=3.3.4) +283 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-jdbc MAVEN version =3.3.0, =3.3.0, =3.3.0, =0.3.0, =9.0.8, =9.0.8, =1.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.11 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

cc.ddrpa.dorian.elias:elias-spring-boot-starter (>=2.5.0, <=2.5.3), cn.fantasticmao.mundo:mundo-data (>=1.0.9, <=1.0.10) +294 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=2.4.0, <=2.4.18)

org.springframework.data:spring-data-jdbc MAVEN version =2.4.0, =2.5.0, =1.0.9, =2.9.2.release, =0.1.8.jre11, =2.4.0, =1.12.2.0, =7.0.0, =7.0.0, =1.5.7, =1.0.8, =2.4.1, =2.4.1, =2.4.1, =2.4.9 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

com.github.fmjsjx:libcommon-r2dbc (>=3.17.0-rc1, <=4.2.2), com.github.fmjsjx:libcommon-r2dbc-kotlin (>=3.17.0-rc1, <=4.2.2) +43 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-r2dbc MAVEN version =4.0.0, =3.17.0-rc1, =3.17.0-rc1, =4.1.0-rc, =8.0.1, =8.0.1, =10.0.1, =10.0.1, =0.1.0, =0.1.0, =0.13.0, =1.8.0, =1.5.0-beta2, =1.0.4, =4.0.0, =5.1.3 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +39 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.4.0, =0.0.1, =0.0.1, =3.11.0-rc1, =3.11.0-rc1, =6.0.0, =6.0.0, =0.6.0, =0.8.0 - io.eventuate.common:eventuate-common-spring-reactive-jdbc 0.21.0.release - io.eventuate.tram.core:eventuate-tram-reactive-consumer-jdbc 0.37.0.release -...

com.alcosi.nft:nft-api-gateway (>=15.0-release, <=15.12-release), com.google.cloud:spring-cloud-gcp-starter-sql-postgres-r2dbc (>=5.5.0, <=5.13.11) +29 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.3.0, =15.0-release, =5.5.0, =5.5.0, =9.0.8, =9.0.8, =0.1.0, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.16 and more Source cves: CVE-2026-41697htt...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +423 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-jdbc MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.4.7, =1.1.0 - com.codbex.atlas:codbex-atlas-application 2.110.0 - com.codbex.atlas:codbex-atlas-branding 2.110.0 - com.codbex.atlas:codbex-atlas-components-parent 2.110.0 -...

CVE-2026-41697 Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

cc.ddrpa.dorian.elias:elias-spring-boot-starter (>=2.5.0, <=2.5.3), cn.fantasticmao.mundo:mundo-data (>=1.0.9, <=1.0.10) +352 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=2.4.0, <=2.4.18)

org.springframework.data:spring-data-relational MAVEN version =2.4.0, =2.5.0, =1.0.9, =2.9.2.release, =0.1.8.jre11, =2.4.0, =1.5.0, =1.11.3.1, =1.12.2.0, =1.11.3.1, =1.2.0, =3.4.0, =3.4.0, =3.9.18 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

CVE-2026-41697

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

CVE-2026-41697

CVE-2026-41697 affects Spring Data Relational/JDBC/R2DBC across multiple versions (4.0.0–4.0.5; 3.5.0–3.5.11; 3.4.0–3.4.14; 3.3.0–3.3.16; 3.2.0–3.2.15; 3.1.0–3.1.14; 3.0.0–3.0.15; 2.4.0–2.4.19). The root cause is improper escaping of binding values for StringMatcher (STARTING, ENDING, CONTAINING)...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +482 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696

Spring Data MongoDB CVE-2026-41696 affects multiple versions (5.0.0–5.0.5; 4.5.0–4.5.11; 4.4.0–4.4.14; 4.3.0–4.3.16; 4.2.0–4.2.15; 4.1.0–4.1.14; 4.0.0–4.0.15; 3.4.0–3.4.19). The issue is insufficient validation of bound parameters in repository query methods annotated with @Query that use regex b...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41696 Source advisory:...

CVE-2026-41696

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

cn.airfei.air-core:core (>=3.0.0, <=3.0.4), cn.allbs:allbs-bom (>=1.1.6, <=2.0.0) +304 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=3.4.0, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.4.0, =3.0.0, =1.1.6, =1.1.6, =0.0.1, =0.0.5, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.3.0 - cn.bootx.platform:service-office 1.2.3 - cn.bootx.platform:service-visualization 1.2.3 and more Source cves:...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), cn.bbwres:biscuit-mongodb-boot-starter (>=3.0.0, <=3.0.2) +251 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.5.0, =1.0.0.ee-20260424025040, =3.0.0, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41696 Source advisory:...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +3960 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.5.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...