CVE-2026-41697

Name of the Vulnerable Software and Affected Versions Spring Data Relational/JDBC/R2DBC versions 4.0.0 through 4.0.5 Spring Data Relational/JDBC/R2DBC versions 3.5.0 through 3.5.11 Spring Data Relational/JDBC/R2DBC versions 3.4.0 through 3.4.14 Spring Data Relational/JDBC/R2DBC versions 3.3.0 through 3.3.16 Spring Data Relational/JDBC/R2DBC versions 3.2.0 through 3.2.15 Spring Data Relational/JDBC/R2DBC versions 3.1.0 through 3.1.14 Spring Data Relational/JDBC/R2DBC versions 3.0.0 through 3.0.15 Spring Data Relational/JDBC/R2DBC versions 2.4.0 through 2.4.19

Description Spring Data Relational fails to properly escape binding values of externally-controlled input when utilizing StringMatcher (STARTING, ENDING, or CONTAINING) within Query By Example (QBE). This allows an attacker to provide wildcard characters to conduct boolean-based blind data inference, a technique used to extract information from a database by observing the true or false responses of the application to specific queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.