CVE-2026-41717

HIGH EPSS 24.6%
Published Jun 10, 20262w ago · Modified Jun 22, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published Jun 10, 2026 2w ago
Last Modified Jun 22, 2026 1w ago

Description

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

CVSS Details

Base Score
8.1
Exploitability
2.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
24.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-917

Affected Products 8

VendorProductVersionRange
vmwarespring_data_mongodb*≥3.4.0  –  ≤3.4.19
vmwarespring_data_mongodb*≥4.0.0  –  ≤4.0.15
vmwarespring_data_mongodb*≥4.1.0  –  ≤4.1.14
vmwarespring_data_mongodb*≥4.2.0  –  ≤4.2.15
vmwarespring_data_mongodb*≥4.3.0  –  ≤4.3.16
vmwarespring_data_mongodb*≥4.4.0  –  ≤4.4.11
vmwarespring_data_mongodb*≥4.5.0  –  ≤4.5.11
vmwarespring_data_mongodb*≥5.0.0  –  ≤5.0.5

References 1

  • spring.io https://spring.io/security/cve-2026-41717
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.