What is the CVSS score of CVE-2026-41696?

CVE-2026-41696 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41696?

Yes, a patch is available for CVE-2026-41696. Update the affected software to the latest version immediately.

Spring Data MongoDB CVE-2026-41696

EUVD-2026-35892 MEDIUM

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-06-10 security@vmware.com

GHSA-hc43-m36c-8v33

Nosql Injection Information Disclosure Java Spring Data Mongodb

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:39 vuln.today

DescriptionCVE.org

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.

Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

AnalysisAI

Regex parameter binding in Spring Data MongoDB's @Query annotation fails to sufficiently quote user-supplied strings, enabling NoSQL injection that can manipulate query semantics. Unauthenticated remote attackers (PR:N, AV:N) who can influence the bound parameter in applications using this pattern may break out of the intended regular expression context to retrieve unintended documents, resulting in high-impact confidentiality compromise. No confirmed active exploitation or public exploit code has been identified at time of analysis; the CVSS Attack Complexity of High reflects a dependency on a specific application-level coding pattern.

Technical ContextAI

Spring Data MongoDB is a Java-based persistence layer in the Spring ecosystem (maintained by VMware/Broadcom) that maps repository method signatures to MongoDB queries. The @Query annotation allows developers to embed MongoDB query templates directly on repository interfaces, with ?0-style placeholder syntax for parameter binding. When a regex operator (e.g., { 'field': { $regex: ?0 } }) is used and a user-supplied value is bound, the framework is expected to quote the value so it is treated as a literal pattern. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic - NoSQL) describes this root cause class: the framework interpolates the parameter into the query structure without fully neutralizing regex metacharacters or operator delimiters, allowing the attacker to alter the query's logical behavior. No CPE strings were supplied in the source data; affected product versions are derived solely from the vendor advisory ranges spanning major branches 3.4.x through 5.0.x.

RemediationAI

Upgrade Spring Data MongoDB to a version beyond the listed affected upper bounds in each branch. The vendor advisory at https://spring.io/security/cve-2026-41696 should be consulted for the exact confirmed fix versions - the source data supplied to this analysis identifies affected ranges but does not explicitly name the first patched release for each branch, so specific fix version numbers cannot be cited here without risk of error. As an immediate compensating control where upgrade is not feasible, developers should audit all repository interfaces using @Query annotations with regex parameter bindings and apply application-level escaping of regex metacharacters before passing values to these methods - for example, wrapping user input with Java's Pattern.quote() prior to binding. Alternatively, refactoring affected queries to use MongoTemplate with an explicit Criteria.where().regex() call allows the application to control quoting explicitly. Removing user-controlled input from @Query regex parameters entirely eliminates the attack surface with no trade-offs. Restricting external access to endpoints that invoke affected repository methods is a partial network-layer mitigation but does not address insider or authenticated-user risk.