ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +766 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-redis (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-redis MAVEN version =3.3.0, =cloud-0.1, =2.1.0, =2.1.0, =2.1.0, =1.0.0, =3.3.0, =3.3.0, =2.2.12, =1.0.10, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.6.1 and more Source cves: CVE-2026-41719 Source advisory: MEND:CVE-2026-41719...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +1038 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-keyvalue MAVEN version =3.5.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.3 - cc.uncarbon.framework:helio-starter-rate-limit-redis 2.5.0 - cc.uncarbon.framework:helio-starter-redis 2.5...

cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +820 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: MEND:CVE-2026-41719...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +786 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.3.0, =cloud-0.1, =2.1.0, =2.1.0, =2.1.0, =1.0.0, =3.3.0, =3.3.0, =2.2.12, =1.0.10, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.6.1 and more Source cves: CVE-2026-41719 Source advisory: MEND:CVE-2026-41719...

CVE-2026-41719

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

CVE-2026-41719 Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

CVE-2026-41719

Technical details about CVE-2026-41719 are not publicly available in the provided documents. Monitor for updates from official advisories; no specifics on affected products, vectors, or fixes are provided here.

CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41717

Spring Data MongoDB contains a SpEL expression injection vulnerability in parameter binding for user-defined repository queries annotated with @Query using a capture-all placeholder. Affected versions include 5.0.0–5.0.5; 4.5.0–4.5.11; 4.4.0–4.4.14; 4.3.0–4.3.16; 4.2.0–4.2.15; 4.1.0–4.1.14; 4.0.0...

CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), cn.bbwres:biscuit-mongodb-boot-starter (>=3.0.0, <=3.0.2) +251 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.5.0, =1.0.0.ee-20260424025040, =3.0.0, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41717 Source advisory:...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41717 Source advisory:...

cn.airfei.air-core:core (>=3.0.0, <=3.0.4), cn.allbs:allbs-bom (>=1.1.6, <=2.0.0) +304 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=3.4.0, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.4.0, =3.0.0, =1.1.6, =1.1.6, =0.0.1, =0.0.5, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.3.0 - cn.bootx.platform:service-office 1.2.3 - cn.bootx.platform:service-visualization 1.2.3 and more Source cves:...

CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41716

CVE-2026-41716 affects Spring Data Commons (versions 2.7.0–2.7.19; 3.3.0–3.3.16; 3.4.0–3.4.14; 3.5.0–3.5.11; 4.0.0–4.0.5). The issue is in Spring Data’s internal property-lookup cache, which accepts and permanently retains attacker-supplied strings as cache keys, enabling heap exhaustion through ...

CVE-2026-41716 Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

CVE-2026-41716

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

CVE-2026-41716 Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

CVE-2026-41716 Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.112.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +3274 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-commons MAVEN version =3.3.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41716 Source advisory: MEND:CVE-2026-41716...