CVE-2026-41717

HighCVSS 8.1

Published: 10/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

SpEL expression injection vulnerability in Spring Data MongoDB. Occurs during parameter binding in repository query methods annotated with @Query using a wildcard placeholder.

Risk Assessment

An attacker can inject malicious SpEL expressions, potentially leading to remote code execution on the application server.

Recommendation

Update Spring Data MongoDB to version 5.0.6, 4.5.12, 4.4.15, 4.3.17, 4.2.16, 4.1.15, 4.0.16, or 3.4.20 (or later).

Other vulnerabilities in Spring Data MongoDB

CVE-2026-41696Medium
Spring Data MongoDB improperly validates regex parameters in @Query annotated repository methods. An attacker can supply a crafted string to bypass intended regular expression quoting.

Original NVD description (English source)

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.