SQL Injection

Spring Data Relational is vulnerable to SQL Injection. The vulnerability is due to insufficient escaping of wildcard characters in user-controlled input, which allows an attacker to inject wildcard patterns and perform boolean-based blind data inference...

K000162894: Spring Data Relational vulnerability CVE-2026-41697

Security Advisory Description Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational [CVE-2026-41697]

Summary IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational, due to a failure to properly escape binding values of externally-controlled input hat can allow an attacker can supply wildcard characters CVE-2026-41697. Spring Data Relational, is used as par...

CVE-2026-41697

A flaw was found in Spring Data Relational. This vulnerability allows a remote attacker to perform boolean-based blind data inference by supplying wildcard characters in externally-controlled input when using StringMatcher in Query By Example QBE. This can lead to the disclosure of sensitive...

EUVD-2026-35893

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

ai.ylyue:yue-library-data-es (>=j8.2.3.0, <=j11.2.6.1), ai.ylyue:yue-library-data-jdbc (>=j8.2.3.0, <=j11.2.6.1) +531 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=2.0.0.release, <=2.4.18)

org.springframework.data:spring-data-relational MAVEN version =2.0.0.release, =j8.2.3.0, =j8.2.3.0, =0.0.1-alpha, =0.0.2-alpha, =2.5.0, =1.0.1, =2.4.5, =1.0.9, =0.0.1, =1.0.0.release, =0.1.8.jre11, =1.0.0, =1.0.0, =4.0.462, =4.0.551 and more Source cves: CVE-2026-41697 Source advisory:...

org.springframework.boot:spring-boot-starter-data-jdbc (2.2.11.release), org.springframework.data:spring-data-jdbc (1.1.11.release) potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.11.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - org.springframework.boot:spring-boot-starter-data-jdbc...

org.springframework.boot:spring-boot-starter-data-jdbc (>=2.2.12.release, <=2.2.13.release), org.springframework.data:spring-data-jdbc (1.1.12.release) potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.12.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - org.springframework.boot:spring-boot-starter-data-jdbc...

cn.cenxt:cenxt-task-scheduler-core (>=0.0.1, <=1.0.5), com.github.jchanghong:parent (>=3.0.11, <=3.0.19) +6 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.3.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.cenxt:cenxt-task-scheduler-core =0.0.1, =3.0.11,...

com.foilen:database-tools (0.4.4), org.nhind:config-service-jar (>=7.0, <=7.0.1) +3 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.4.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.foilen:database-tools 0.4.4 -...

org.springframework.data:spring-data-jdbc (1.1.13.release) potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.13.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - org.springframework.data:spring-data-jdbc 1.1.13.release...

GHSA-8R2H-XH92-GQ57 Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

com.xieahui.springboot:spring-boot-easy-connection-pool (>=1.0-release, <=1.1.2-release), org.springframework.boot:spring-boot-starter-data-jdbc (2.2.7.release) +2 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.7.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.xieahui.springboot:spring-boot-easy-connection-pool...

com.github.jchanghong:test (2.2.6), com.github.jchanghong:utils (2.2.6) +2 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.6.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.github.jchanghong:test 2.2.6 -...

cn.fxbin.bubble:bubble-fireworks-data-mybatis (0.0.3-release), cn.fxbin.bubble:bubble-fireworks-starter-mybatis (0.0.3-release) +2 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.8.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.fxbin.bubble:bubble-fireworks-data-mybatis 0.0.3-relea...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), ai.ylyue:yue-library-data-jdbc (>=j8.2.2.0, <=j11.2.2.0) +11 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.5.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - ai.ylyue:yue-library-data-es =j8.2.2.0, =j8.2.2.0,...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +610 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-relational MAVEN version =3.4.0, =0.0.1, =0.0.1, =2.0.0-release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =2.51.0 and more Source cves: CVE-2026-41697 Source advisory: GHSA-8R2H-XH92-GQ57https://vulners.com/github/GHSA-8R...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +481 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: GHSA-8R2H-XH92-GQ57...

cn.guomw.cloud:framework-cloud-starter-web (>=1.0.0.release, <=1.1.0.1.btxc.release), org.nhind:config-service-jar (7.0.2) +3 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.9.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.guomw.cloud:framework-cloud-starter-web =1.0.0.release...