MEDIUM | JUNE 09, 2026 | CVE-2026-41697
Description
Spring Data Relational does not properly escape binging values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE).
If an application actively wires externally-controlled input into a QBE probe, an attacker can supply wildcard characters to perform boolean-based blind data inference, allowing them to guess data within the queried entity.
This vulnerability is not exploitable by default. It requires the application developer to explicitly configure and expose a QBE probe that accepts untrusted input.
Affected Spring Products and Versions
Spring Data Relational:
- 4.0.0 - 4.0.5
- 3.5.0 - 3.5.11
- 3.4.0 - 3.4.14
- 3.3.0 - 3.3.16
- 3.2.0 - 3.2.15
- 3.1.0 - 3.0.14
- 3.0.0 - 3.0.15
- 2.4.0 - 2.4.19
- older unsupported versions
Spring Data JDBC (through Spring Data Relational)
- 4.0.0 - 4.0.5
- 3.5.0 - 3.5.11
- 3.4.0 - 3.4.14
- 3.3.0 - 3.3.16
- 3.2.0 - 3.2.15
- 3.1.0 - 3.0.14
- 3.0.0 - 3.0.15
- 2.4.0 - 2.4.19
- older unsupported versions
Spring Data R2DBC (through Spring Data Relational)
- 4.0.0 - 4.0.5
- 3.5.0 - 3.5.11
- 3.4.0 - 3.4.14
- 3.3.0 - 3.3.16
- 3.2.0 - 3.2.15
- 3.1.0 - 3.0.14
- 3.0.0 - 3.0.15
- 1.5.0 - 1.5.19
- older unsupported versions
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 4.0.x | 4.0.6 | OSS |
| 3.5.x | 3.5.12 | OSS |
| 3.4.x | 3.4.15 | Enterprise Support Only |
| 3.3.x | 3.3.17 | Enterprise Support Only |
| 2.4.x | 2.4.20 | Enterprise Support Only |
References
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy