Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-41719

Summary
Assigner-vmware
Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d
Published At-09 Jun, 2026 | 23:48
Updated At-30 Jun, 2026 | 21:42
Rejected At-
Credits

Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:vmware
Assigner Org ID:dcf2e128-44bd-42ed-91e8-88f912c1401d
Published At:09 Jun, 2026 | 23:48
Updated At:30 Jun, 2026 | 21:42
Rejected At:
▼CVE Numbering Authority (CNA)
Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Affected Products
Vendor
VMware (Broadcom Inc.)Spring
Product
Spring Data KeyValue
Default Status
unaffected
Versions
Affected
  • From 4.0.0 before 4.0.5.1 (custom)
  • From 3.5.0 before 3.5.11.1 (custom)
  • From 3.4.0 before 3.4.15 (custom)
  • From 3.3.0 before 3.3.17 (custom)
  • From 3.2.0 before 3.2.16 (custom)
  • From 3.1.0 before 3.1.15 (custom)
  • From 3.0.0 before 3.0.16 (custom)
  • From 2.7.0 before 2.7.20 (custom)
Vendor
VMware (Broadcom Inc.)Spring
Product
Spring Data Redis
Default Status
unaffected
Versions
Affected
  • From 4.0.0 before 4.0.5.1 (custom)
  • From 3.5.0 before 3.5.11.1 (custom)
  • From 3.4.0 before 3.4.15 (custom)
  • From 3.3.0 before 3.3.17 (custom)
  • From 3.2.0 before 3.2.16 (custom)
  • From 3.1.0 before 3.1.15 (custom)
  • From 3.0.0 before 3.0.16 (custom)
  • From 2.7.0 before 2.7.20 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-917CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
Type: CWE
CWE ID: CWE-917
Description: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
Metrics
VersionBase scoreBase severityVector
3.16.4MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Version: 3.1
Base score: 6.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
N/AAn attacker who can supply unsanitized Sort input to a Spring Data KeyValue repository method using SpelPropertyComparator can inject arbitrary SpEL expressions.
CAPEC ID: N/A
Description: An attacker who can supply unsanitized Sort input to a Spring Data KeyValue repository method using SpelPropertyComparator can inject arbitrary SpEL expressions.
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://spring.io/security/cve-2026-41719
N/A
Hyperlink: https://spring.io/security/cve-2026-41719
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@vmware.com
Published At:10 Jun, 2026 | 00:16
Updated At:23 Jul, 2026 | 09:10

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.16.4MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
N/A
Type: Secondary
Version: 3.1
Base score: 6.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Type: N/A
Version:
Base score:
Base severity: N/A
Vector:
CPE Matches
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 2.7.0(inclusive) to 2.7.20(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 3.0.0(inclusive) to 3.0.16(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 3.1.0(inclusive) to 3.1.15(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 3.2.0(inclusive) to 3.2.16(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 3.3.0(inclusive) to 3.3.17(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 3.4.0(inclusive) to 3.4.15(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 3.5.0(inclusive) to 3.5.11.1(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_keyvalue>>Versions from 4.0.0(inclusive) to 4.0.5.1(exclusive)
cpe:2.3:a:broadcom:spring_data_keyvalue:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 2.7.0(inclusive) to 2.7.20(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 3.0.0(inclusive) to 3.0.16(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 3.1.0(inclusive) to 3.1.15(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 3.2.0(inclusive) to 3.2.16(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 3.3.0(inclusive) to 3.3.17(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 3.4.0(inclusive) to 3.4.15(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 3.5.0(inclusive) to 3.5.11.1(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Broadcom Inc.
broadcom
>>spring_data_redis>>Versions from 4.0.0(inclusive) to 4.0.5.1(exclusive)
cpe:2.3:a:broadcom:spring_data_redis:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-917Secondarysecurity@vmware.com
CWE ID: CWE-917
Type: Secondary
Source: security@vmware.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://spring.io/security/cve-2026-41719security@vmware.com
Vendor Advisory
Hyperlink: https://spring.io/security/cve-2026-41719
Source: security@vmware.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

6Records found
CVE-2026-41705
Matching Score-6
Assigner-VMware by Broadcom
ShareView Details
Matching Score-6
Assigner-VMware by Broadcom
CVSS Score-8.6||HIGH
EPSS-0.35% / 27.83%
||
7 Day CHG~0.00%
Published-09 May, 2026 | 00:34
Updated-24 Jul, 2026 | 21:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.

Action-Not Available
Vendor-VMware (Broadcom Inc.)
Product-spring_aiSpring AI
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2026-41717
Matching Score-6
Assigner-VMware by Broadcom
ShareView Details
Matching Score-6
Assigner-VMware by Broadcom
CVSS Score-8.1||HIGH
EPSS-0.33% / 25.26%
||
7 Day CHG~0.00%
Published-09 Jun, 2026 | 23:48
Updated-23 Jul, 2026 | 09:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

Action-Not Available
Vendor-VMware (Broadcom Inc.)
Product-spring_data_mongodbSpring Data MongoDB
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2026-41729
Matching Score-6
Assigner-VMware by Broadcom
ShareView Details
Matching Score-6
Assigner-VMware by Broadcom
CVSS Score-8.1||HIGH
EPSS-0.39% / 31.92%
||
7 Day CHG~0.00%
Published-09 Jun, 2026 | 23:49
Updated-23 Jul, 2026 | 09:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Spring Data REST SpEL Injection via Map Key in JSON Patch

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

Action-Not Available
Vendor-VMware (Broadcom Inc.)
Product-spring_data_restSpring Data REST
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2026-40985
Matching Score-6
Assigner-VMware by Broadcom
ShareView Details
Matching Score-6
Assigner-VMware by Broadcom
CVSS Score-6.4||MEDIUM
EPSS-0.22% / 13.26%
||
7 Day CHG~0.00%
Published-11 Jun, 2026 | 05:02
Updated-23 Jul, 2026 | 09:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

Action-Not Available
Vendor-VMware (Broadcom Inc.)
Product-Spring Web Flow
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2026-22738
Matching Score-6
Assigner-VMware by Broadcom
ShareView Details
Matching Score-6
Assigner-VMware by Broadcom
CVSS Score-9.8||CRITICAL
EPSS-1.09% / 61.85%
||
7 Day CHG+0.27%
Published-27 Mar, 2026 | 05:21
Updated-10 May, 2026 | 14:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Action-Not Available
Vendor-VMware (Broadcom Inc.)
Product-spring_aiSpring AI
CWE ID-CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2025-41243
Matching Score-6
Assigner-VMware by Broadcom
ShareView Details
Matching Score-6
Assigner-VMware by Broadcom
CVSS Score-10||CRITICAL
EPSS-3.31% / 87.28%
||
7 Day CHG~0.00%
Published-16 Sep, 2025 | 14:54
Updated-26 Feb, 2026 | 17:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Action-Not Available
Vendor-VMware (Broadcom Inc.)
Product-Cloud Gateway
CWE ID-CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
Details not found