CVE-2026-41719

6.4 Moyenne

Publiée le 10/06/2026 à 02:16 · Modifiée le 23/07/2026 à 11:10 · Analysée par le NVD · Source : security@vmware.com

Description

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Traduire en français

Produits concernés

Spring Data KeyValue
Spring Data Redis
Broadcom spring data keyvalue
Broadcom spring data redis

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.4 Moyenne	security@vmware.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L`

Faiblesses (CWE)

CWE-917

Références

https://spring.io/security/cve-2026-41719 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories