Spring Data MongoDB Vulnerability in Regex Parameter Binding
CVE-2026-41696

5.9MEDIUM

Key Information:

Vendor

Spring

Status
Spring Data Mongodb
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41696?

The vulnerability in Spring Data MongoDB arises from inadequate validation of regex parameter bindings in repository query methods annotated with @Query. This flaw enables an attacker to exploit the system by submitting a specially crafted string, which can break out of the intended regular expression quotes. This improper handling of user input may lead to the execution of malicious queries and compromising the integrity of the data.

Affected Version(s)

Spring Data MongoDB 5.0.0 < 5.0.6

Spring Data MongoDB 4.5.0 < 4.5.12

Spring Data MongoDB 4.4.0 < 4.4.15

References

https://spring.io/security/cve-2026-41696

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.