CVE-2026-41697 Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
Attackers can inject wildcard characters in Query By Example LIKE patterns to perform blind data inference, requiring an upgrade to patched Spring Data Relational versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41697?
CVE-2026-41697 is a medium-severity SQL injection vulnerability in Spring Data JDBC, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.
Affected versions: Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.4.0 through 2.4.19.
Weakness: CWE-943
Which versions are affected by CVE-2026-41697?
10 open source packages ship an affected version, including org.springframework.data:spring-data-relational. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-relational Maven | All versions to 2.4.19 | None |
org.springframework.data:spring-data-relational Maven | All versions to 2.4.19 | None |
org.springframework.data:spring-data-relational Maven | From 3.0.0 to 3.3.16 | None |
org.springframework.data:spring-data-relational Maven | From 3.0.0 to 3.3.16 | None |
org.springframework.data:spring-data-relational Maven | From 3.4.0 to 3.4.14 | None |
org.springframework.data:spring-data-relational Maven | From 3.4.0 to 3.4.14 | None |
4 more packages
org.springframework.data:spring-data-relational Maven | From 3.5.0 | 3.5.12 |
org.springframework.data:spring-data-relational Maven | From 3.5.0 | 3.5.12 |
org.springframework.data:spring-data-relational Maven | From 4.0.0 | 4.0.6 |
org.springframework.data:spring-data-relational Maven | From 4.0.0 | 4.0.6 |
Products include Broadcom Spring Data Relational.
How do I fix CVE-2026-41697?
Upgrade org.springframework.data:spring-data-relational to a fixed version for your release line: 3.5.12 or 4.0.6.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-41697 being exploited?
There is no known exploitation of CVE-2026-41697 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1791381930, CLSA-2026-1791983363, CLSA-2026-1792429184, CLSA-2026-1793194299, GHSA-8r2h-xh92-gq57, MINI-3rrc-mf2w-ppx7.