CVE-2026-41719: Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

June 10, 2026 (updated August 12, 2026)

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

References

github.com/advisories/GHSA-xg2j-3hj6-pc24
github.com/spring-projects/spring-data-keyvalue/releases/tag/3.5.12
github.com/spring-projects/spring-data-keyvalue/releases/tag/4.0.6
nvd.nist.gov/vuln/detail/CVE-2026-41719
spring.io/security/cve-2026-41719

Code Behaviors & Features

Detect and mitigate CVE-2026-41719 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →