CVE-2026-41697
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Spring Data Relational involves improper escaping of binding values for externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Risk Assessment
The risk involves potential leakage of sensitive data through blind boolean-based inference attacks, which may lead to a breach of confidentiality of information stored in the database.
Recommendation
It is recommended to immediately upgrade Spring Data Relational/JDBC/R2DBC to version 4.0.6, 3.5.12, 3.4.15, 3.3.17, 3.2.16, 3.1.15, 3.0.16, or 2.4.20, depending on the release line used.
Original NVD description (English source)
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.