CVE-2026-47834: Spring Data JPA Sort expression validation bypass
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Spring Data JPA are exposed when Sort parameters can be supplied from untrusted sources. The affected versions listed are 4.1.0, 4.0.0 through 4.0.6, 3.5.0 through 3.5.13, and 3.0.0 through 3.4.15.
What does an attacker need to exploit the vulnerability?
An attacker needs a path to provide crafted payloads in parameters that are used for Spring Data JPA Sort handling. No privileges or user interaction are required, but exploitation has high attack complexity.
Is a default configuration necessarily affected?
The available information does not establish that every default Spring Data JPA configuration is vulnerable. Exposure depends on whether Sort parameters containing untrusted input are accepted.
What can be done if patching is not immediately possible?
Avoid accepting Sort parameters directly from untrusted sources, or restrict them to an application-controlled allowlist of permitted sort properties and directions. This reduces the opportunity to supply crafted values that bypass Sort validation.