CVE-2026-41696: Spring Data MongoDB, инжекция

Описание

Оригинално описание

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

Засегнати продукти

• Spring Spring Data MongoDB: 5.0.0 преди 5.0.6; 4.5.0 преди 4.5.12; 4.4.0 преди 4.4.15; 4.3.0 преди 4.3.17; 4.2.0 преди 4.2.16; 4.1.0 преди 4.1.15; 4.0.0 преди 4.0.16; 3.4.0 преди 3.4.20

Вид слабост

• CWE-943 Improper Neutralization of Special Elements in Data Query Logic

История

Други уязвимости в Spring Spring Data MongoDB

• 8.1CVE-2026-41717

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-41696
• https://nvd.nist.gov/vuln/detail/CVE-2026-41696
• https://spring.io/security/cve-2026-41696