org.springframework.data/spring-data-mongodb vulnerabilities

Latest org.springframework.data/spring-data-mongodb CVEs

Newest publication first

1. CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

   Published 2026-06-09

   High·CVSS 8.1 EPSS 0.33%

   Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Da...

2. CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

   Published 2026-06-09

   Medium·CVSS 5.9 EPSS 0.26%

   Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring D...

3. CVE-2022-22980 SpEL Injection in Spring Data MongoDB

   Published 2022-06-22

   Critical·CVSS 9.8 EPSS 17.8%

   A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.