AIKIDO-2026-226218

spring-data-relational is vulnerable to Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Special Elements in Data Query LogicCVE-2026-41697 Published Today

Medium Risk

This Affects:

spring-data-relational

0.0.0 - 2.4.19

Fixed in 2.4.20

3.3.0 - 3.3.16

Fixed in 3.3.17

3.4.0 - 3.4.14

Fixed in 3.4.15

3.5.0 - 3.5.11

Fixed in 3.5.12

4.0.0 - 4.0.5

Fixed in 4.0.6

Are you affected? Scan for Free

TL;DR

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). If an application actively wires externally-controlled input into a QBE probe, an attacker can supply wildcard characters to perform boolean-based blind data inference, allowing them to guess data within the queried entity.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and it requires the application developer to explicitly configure and expose a QBE probe that accepts untrusted input.

Background info

spring-data-relational is vulnerable to Improper Neutralization of Special Elements in Data Query Logic in versions 0.0.0 - 2.4.19, 3.3.0 - 3.3.16, 3.4.0 - 3.4.14, 3.5.0 - 3.5.11 and 4.0.0 - 4.0.5.