Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-47834

Spring Data JPA Sort expression validation bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Data JPA

Default version status: unaffected

  • 4.1.0affected
  • 4.0.0 to ≤ 4.0.6affected
  • 3.5.0 to ≤ 3.5.13affected
  • 3.0.0 to ≤ 3.4.15affected

References