What is the CVSS score of CVE-2026-41719?

CVE-2026-41719 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41719?

Yes, a patch is available for CVE-2026-41719. Update the affected software to the latest version immediately.

Spring Data KeyValue CVE-2026-41719

EUVD-2026-35901 MEDIUM

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-06-10 security@vmware.com

GHSA-xg2j-3hj6-pc24

Java Redis Code Injection Broadcom Red Hat Spring Data Keyvalue Spring Data Redis

6.4

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:42 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

151 maven packages depend on org.springframework.data:spring-data-keyvalue (3 direct, 148 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

AnalysisAI

SpEL (Spring Expression Language) injection in Spring Data KeyValue and Spring Data Redis allows a network-accessible, low-privileged attacker to execute arbitrary SpEL expressions when applications pass unsanitized user-controlled Sort parameters directly to repository query methods delegating to SpelPropertyComparator. Affected versions span eight major release lines from 2.7.x through 4.0.x, making the exposure surface broad across Spring-based Java ecosystems. No public exploit identified at time of analysis and no CISA KEV listing, but the high confidentiality impact rating and network attack vector warrant prompt patching for any application that surfaces Sort query parameters to end users.

Technical ContextAI

CWE-917 (Improper Neutralization of Special Elements in an Expression Language Statement) describes the root cause: SpEL is a powerful runtime expression language built into the Spring Framework that can traverse and manipulate the JVM object graph, invoke methods, and access system properties. Spring Data KeyValue uses SpelPropertyComparator to evaluate property-path expressions when sorting in-memory key-value query results. If a caller constructs a Sort object directly from unsanitized user input and passes it to a repository method backed by SpelPropertyComparator, that user-supplied string reaches the SpEL evaluator without sanitization. This is analogous to OGNL or EL injection patterns well-documented in Java frameworks. Spring Data Redis inherits this behavior because it is built on the Spring Data KeyValue infrastructure. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L indicates network delivery, no user interaction beyond the attacker's own authenticated session, and high confidentiality impact with partial integrity and availability loss - consistent with the read/execute capability that SpEL injection can provide.

RemediationAI

Upgrade to a fixed version of Spring Data KeyValue or Spring Data Redis as documented in the vendor advisory at https://spring.io/security/cve-2026-41719. Exact patched version numbers are not explicitly stated in the provided data - consult the advisory directly to identify the minimum safe version for your release line (e.g., the next patch release beyond each affected band). As an immediate compensating control, audit all repository query methods that accept Sort parameters and ensure no Sort object is constructed from raw, unsanitized user input; instead, restrict Sort to a strict allowlist of known property names validated before constructing the Sort object. This eliminates the injection vector regardless of framework version and is a sound long-term practice even after patching. Note that disabling SpEL globally in the Spring context is not a supported or safe workaround as it would break legitimate framework functionality. Dependency scanning tools (e.g., OWASP Dependency-Check, Dependabot) should be configured to flag the affected version ranges.