CVE-2026-41719: Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

Q: What is the severity of CVE-2026-41719?

CVE-2026-41719 has a medium severity rating of 6.4.

Q: What is the impact of CVE-2026-41719?

CVE-2026-41719 allows SpEL Injection, which can lead to potential information disclosure and local modifications.

Q: How can I mitigate CVE-2026-41719?

To mitigate CVE-2026-41719, ensure that user input passed to repository query methods is properly sanitized and validated.

Q: Which versions are affected by CVE-2026-41719?

CVE-2026-41719 affects Spring Data KeyValue and Spring Data Redis versions from 3.5.0 to 4.0.5.

Q: Where can I find more information about CVE-2026-41719?

More detailed information regarding CVE-2026-41719 can be found in the official Spring security announcements.

Published Jun 9, 2026

Updated

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Affected Software

18 affected components

maven/org.springframework.data/spring-data-keyvalue>=4.0.0<=4.0.5, >=3.5.0<=3.5.11, >=3.4.0<=3.4.14, >=3.3.0<=3.3.16, >=3.2.0<=3.2.15, >=3.1.0<=3.1.14, >=3.0.0<=3.0.15, >=2.7.0<=2.7.19

maven/org.springframework.data/spring-data-redis>=4.0.0<=4.0.5, >=3.5.0<=3.5.11, >=3.4.0<=3.4.14, >=3.3.0<=3.3.16, >=3.2.0<=3.2.15, >=3.1.0<=3.1.14, >=3.0.0<=3.0.15, >=2.7.0<=2.7.19

Broadcom Spring Data Keyvalue>=2.7.0<2.7.20

Broadcom Spring Data Keyvalue>=3.0.0<3.0.16

Broadcom Spring Data Keyvalue>=3.1.0<3.1.15

Broadcom Spring Data Keyvalue>=3.2.0<3.2.16

Broadcom Spring Data Keyvalue>=3.3.0<3.3.17

Broadcom Spring Data Keyvalue>=3.4.0<3.4.15

Broadcom Spring Data Keyvalue>=3.5.0<3.5.11.1

Broadcom Spring Data Keyvalue>=4.0.0<4.0.5.1

Broadcom Spring Data Redis>=2.7.0<2.7.20

Broadcom Spring Data Redis>=3.0.0<3.0.16

Broadcom Spring Data Redis>=3.1.0<3.1.15

Broadcom Spring Data Redis>=3.2.0<3.2.16

Broadcom Spring Data Redis>=3.3.0<3.3.17

Broadcom Spring Data Redis>=3.4.0<3.4.15

Broadcom Spring Data Redis>=3.5.0<3.5.11.1

Broadcom Spring Data Redis>=4.0.0<4.0.5.1

Event History

Jun 9, 2026

CVE Published

via MITRE·11:48 PM

Data Sourced

via MITRE·11:48 PM

DescriptionSeverityWeakness

Jun 10, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-41719?

CVE-2026-41719 has a medium severity rating of 6.4.

What is the impact of CVE-2026-41719?

CVE-2026-41719 allows SpEL Injection, which can lead to potential information disclosure and local modifications.

How can I mitigate CVE-2026-41719?

To mitigate CVE-2026-41719, ensure that user input passed to repository query methods is properly sanitized and validated.

Which versions are affected by CVE-2026-41719?

CVE-2026-41719 affects Spring Data KeyValue and Spring Data Redis versions from 3.5.0 to 4.0.5.

Where can I find more information about CVE-2026-41719?