Spring Data MongoDB vulnerabilities

Latest Spring Data MongoDB CVEs

Newest publication first

1. CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

   Published 2026-06-09

   High·CVSS 8.1 EPSS 0.33%

   Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Da...

2. CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

   Published 2026-06-09

   Medium·CVSS 5.9 EPSS 0.26%

   Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring D...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.