CVE-2026-41717

Name of the Vulnerable Software and Affected Versions Spring Data MongoDB versions 5.0.0 through 5.0.5 Spring Data MongoDB versions 4.5.0 through 4.5.11 Spring Data MongoDB versions 4.4.0 through 4.4.14 Spring Data MongoDB versions 4.3.0 through 4.3.16 Spring Data MongoDB versions 4.2.0 through 4.2.15 Spring Data MongoDB versions 4.1.0 through 4.1.14 Spring Data MongoDB versions 4.0.0 through 4.0.15 Spring Data MongoDB versions 3.4.0 through 3.4.19

Description An expression injection issue exists involving Spring Expression Language (SpEL), which is a powerful expression language for the Spring Framework. The problem occurs during parameter binding when a user-defined repository query method is annotated with @Query and uses a capture-all placeholder, potentially enabling remote code execution (RCE).

Recommendations Update versions 5.0.0 through 5.0.5 to a newer version containing the fix. Update versions 4.5.0 through 4.5.11 to version 4.5.12. Update versions 4.4.0 through 4.4.14 to a newer version containing the fix. Update versions 4.3.0 through 4.3.16 to a newer version containing the fix. Update versions 4.2.0 through 4.2.15 to a newer version containing the fix. Update versions 4.1.0 through 4.1.14 to a newer version containing the fix. Update versions 4.0.0 through 4.0.15 to a newer version containing the fix. Update versions 3.4.0 through 3.4.19 to a newer version containing the fix.