CVE-2026-41696
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Spring Data MongoDB improperly validates regex parameters in @Query annotated repository methods. An attacker can supply a crafted string to bypass intended regular expression quoting.
Risk Assessment
The risk involves potential unauthorized queries to the MongoDB database, which could lead to data leakage or modification.
Recommendation
Immediately upgrade Spring Data MongoDB to version 5.0.6, 4.5.12, 4.4.15, 4.3.17, 4.2.16, 4.1.15, 4.0.16, or 3.4.20 depending on the branch used.
Other vulnerabilities in Spring Data MongoDB
Original NVD description (English source)
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.