What is the CVSS score of CVE-2026-41697?

CVE-2026-41697 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41697?

Yes, a patch is available for CVE-2026-41697. Update the affected software to the latest version immediately.

Spring Data Relational CVE-2026-41697

EUVD-2026-35893 MEDIUM

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-06-10 security@vmware.com

GHSA-8r2h-xh92-gq57

Nosql Injection Information Disclosure Java

4.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:40 vuln.today

DescriptionCVE.org

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.

Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.

AnalysisAI

Boolean-based blind query injection in Spring Data Relational (JDBC and R2DBC) allows remote unauthenticated attackers to infer database contents by supplying wildcard characters to Query By Example (QBE) endpoints using StringMatcher modes STARTING, ENDING, or CONTAINING. The root cause is insufficient escaping of externally-controlled binding values before they reach the underlying query logic. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface makes this a meaningful exposure for any Spring Data application that exposes QBE search functionality.

Technical ContextAI

Spring Data Relational is the Spring ecosystem's abstraction layer for relational databases via JDBC and R2DBC. Query By Example (QBE) is a Spring Data feature that constructs queries dynamically from domain object instances. When using StringMatcher modes STARTING ('foo%'), ENDING ('%foo'), or CONTAINING ('%foo%'), the framework appends SQL LIKE wildcards to input values. The vulnerability (CWE-943 - Improper Neutralization of Special Elements in Data Query Logic) arises because externally-controlled input is not properly escaped before the wildcard characters are appended, meaning an attacker-supplied '%' or '_' character is not neutralized and passes directly into the generated query predicate. This enables boolean-based blind inference: by submitting carefully crafted wildcard patterns and observing whether queries return results or not, an attacker can iteratively reconstruct data values from the database without direct read output. Affected CPE covers org.springframework.data spring-data-relational, spring-data-jdbc, and spring-data-r2dbc across all listed version branches.

RemediationAI

Upgrade to a version of Spring Data Relational/JDBC/R2DBC beyond the affected ranges per the vendor advisory at https://spring.io/security/cve-2026-41697. The input data lists affected ranges ending at 4.0.5, 3.5.11, 3.4.14, 3.3.16, 3.2.15, 3.1.14, 3.0.15, and 2.4.19, but does not explicitly state the patched release versions - consult the vendor advisory to confirm the exact fixed version for your branch before upgrading. If immediate patching is not feasible, the most actionable compensating control is to remove StringMatcher.STARTING, StringMatcher.ENDING, and StringMatcher.CONTAINING from any QBE queries that accept external user input, replacing them with exact-match queries (StringMatcher.DEFAULT or StringMatcher.EXACT) - this eliminates the wildcard injection surface entirely but removes partial-match search functionality. Alternatively, sanitize input by stripping or escaping SQL wildcard characters ('%', '_') before passing values to QBE matchers as an interim measure, accepting that this is an application-layer workaround rather than a framework fix. Restrict unauthenticated access to endpoints backed by QBE with wildcard matchers as an additional defense-in-depth measure.