CVE-2026-41696: Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Q: What is the severity of CVE-2026-41696?

CVE-2026-41696 has a medium severity rating of 5.9.

Q: How do I fix CVE-2026-41696?

To mitigate CVE-2026-41696, upgrade to a non-affected version of Spring Data MongoDB.

Q: What software is affected by CVE-2026-41696?

CVE-2026-41696 affects Spring Data MongoDB versions starting from 5.0.0.

Q: What type of vulnerability is CVE-2026-41696?

CVE-2026-41696 is a vulnerability related to insufficient validation in regex parameter binding.

Q: What impact can CVE-2026-41696 have on my application?

CVE-2026-41696 can allow attackers to manipulate queries by breaking out of intended regex quoting, potentially leading to unauthorized data access.

Published Jun 9, 2026

Updated

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.

Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

Affected Software

9 affected components

maven/org.springframework.data/spring-data-mongodb>=5.0.0<=5.0.5, >=4.5.0<=4.5.11, >=4.4.0<=4.4.14, >=4.3.0<=4.3.16, >=4.2.0<=4.2.15, >=4.1.0<=4.1.14, >=4.0.0<=4.0.15, >=3.4.0<=3.4.19

VMware Spring Data MongoDB>=3.4.0<3.4.20

VMware Spring Data MongoDB>=4.0.0<=4.0.15

VMware Spring Data MongoDB>=4.1.0<=4.1.14

VMware Spring Data MongoDB>=4.2.0<=4.2.15

VMware Spring Data MongoDB>=4.3.0<4.3.17

VMware Spring Data MongoDB>=4.4.0<4.4.15

VMware Spring Data MongoDB>=4.5.0<4.5.11.1

VMware Spring Data MongoDB>=5.0.0<5.0.5.1

Event History

Jun 9, 2026

CVE Published

via MITRE·11:47 PM

Data Sourced

via MITRE·11:47 PM

DescriptionSeverityWeakness

Jun 10, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-41696?

CVE-2026-41696 has a medium severity rating of 5.9.

How do I fix CVE-2026-41696?

To mitigate CVE-2026-41696, upgrade to a non-affected version of Spring Data MongoDB.

What software is affected by CVE-2026-41696?

CVE-2026-41696 affects Spring Data MongoDB versions starting from 5.0.0.

What type of vulnerability is CVE-2026-41696?

CVE-2026-41696 is a vulnerability related to insufficient validation in regex parameter binding.

What impact can CVE-2026-41696 have on my application?