CVE-2026-41719

Name of the Vulnerable Software and Affected Versions Spring Data KeyValue / Spring Data Redis versions 4.0.0 through 4.0.5 Spring Data KeyValue / Spring Data Redis versions 3.5.0 through 3.5.11 Spring Data KeyValue / Spring Data Redis versions 3.4.0 through 3.4.14 Spring Data KeyValue / Spring Data Redis versions 3.3.0 through 3.3.16 Spring Data KeyValue / Spring Data Redis versions 3.2.0 through 3.2.15 Spring Data KeyValue / Spring Data Redis versions 3.1.0 through 3.1.14 Spring Data KeyValue / Spring Data Redis versions 3.0.0 through 3.0.15 Spring Data KeyValue / Spring Data Redis versions 2.7.0 through 2.7.19

Description A SpEL Injection issue occurs when unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator() function. SpEL (Spring Expression Language) is a powerful expression language that allows querying and manipulating an object graph at runtime.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.