HIGH | JUNE 09, 2026 | CVE-2026-41717
Description
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.
The application is vulnerable if all conditions below are true:
- Defines an
@Queryor@Aggregationannotated repository method using a capture all placeholder as in@Query("?0")or@Query(":#{?0}"). - Exposes that method to untrusted input (e.g., via spring-data-rest or custom web endpoint)
- Passes unsanitized user input directly to the method.
Affected Spring Products and Versions
Spring Data MongoDB:
- 5.0.0 to 5.0.5
- 4.5.0 to 4.5.11
- 4.4.0 to 4.4.14
- 4.3.0 to 4.3.16
- 4.2.0 to 4.2.15
- 4.1.0 to 4.1.14
- 4.0.0 to 4.0.15
- 3.4.0 to 3.4.19
- older unsupported versions
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 5.0.x | 5.0.6 | OSS |
| 4.5.x | 4.5.12 | OSS |
| 4.4.x | 4.4.15 | Enterprise Support Only |
| 4.3.x | 4.3.17 | Enterprise Support Only |
| 3.4.x | 3.4.20 | Enterprise Support Only |
References
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy