CVE-2026-41696

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41696", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-04-22T06:21:22.981Z", "datePublished": "2026-06-09T23:47:37.883Z", "dateUpdated": "2026-06-10T17:53:14.235Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-09T23:47:37.883Z"}, "title": "Spring Data MongoDB Bind Parameter Literal Quoting Breakout", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "An attacker who can supply a crafted string to a @Query regex binding can break out of literal quoting, potentially exposing unauthorized data or bypassing intended query filters."}]}], "affected": [{"vendor": "Spring", "product": "Spring Data MongoDB", "defaultStatus": "unaffected", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.6", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.12", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.15", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.17", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.16", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.15", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.16", "versionType": "custom"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.20", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."}]}], "references": [{"url": "https://spring.io/security/cve-2026-41696"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T17:52:05.245642Z", "id": "CVE-2026-41696", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T17:53:14.235Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41696", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T17:52:05.245642Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T17:53:09.993Z"}}], "cna": {"title": "Spring Data MongoDB Bind Parameter Literal Quoting Breakout", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "An attacker who can supply a crafted string to a @Query regex binding can break out of literal quoting, potentially exposing unauthorized data or bypassing intended query filters."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring Data MongoDB", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.6", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.12", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.15", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.17", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.16", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.15", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.16", "versionType": "custom"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.20", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-41696"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.", "supportingMedia": [{"type": "text/html", "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-09T23:47:37.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41696", "state": "PUBLISHED", "dateUpdated": "2026-06-10T17:53:14.235Z", "dateReserved": "2026-04-22T06:21:22.981Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-06-09T23:47:37.883Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spring Data MongoDB", "vendor": "Spring", "versions": [{"lessThan": "5.0.6", "status": "affected", "version": "5.0.0", "versionType": "custom"}, {"lessThan": "4.5.12", "status": "affected", "version": "4.5.0", "versionType": "custom"}, {"lessThan": "4.4.15", "status": "affected", "version": "4.4.0", "versionType": "custom"}, {"lessThan": "4.3.17", "status": "affected", "version": "4.3.0", "versionType": "custom"}, {"lessThan": "4.2.16", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.1.15", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.0.16", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "3.4.20", "status": "affected", "version": "3.4.0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E55F58B-81A9-4912-9573-5B452BC55E51", "versionEndExcluding": "3.4.20", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BEBCD2A-409F-4DEF-AF40-9EEC62A099C2", "versionEndIncluding": "4.0.15", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5820FCC-F941-4399-B2B9-EDC5EE3F6953", "versionEndIncluding": "4.1.14", "versionStartIncluding": "4.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "67E36C20-FF20-4F82-B161-74E3838D67FD", "versionEndIncluding": "4.2.15", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5BFEA5F-410F-441E-9DC9-34C03B566E50", "versionEndExcluding": "4.3.17", "versionStartIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "F0BD2306-031F-4D72-BC3E-19ACB886E73D", "versionEndExcluding": "4.4.15", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "D21BA806-10F0-4DA5-9DB6-A669FA01E1CE", "versionEndExcluding": "4.5.11.1", "versionStartIncluding": "4.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_data_mongodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F530EDE-94AE-42FA-A6FE-458CAC0B7EF3", "versionEndExcluding": "5.0.5.1", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."}, {"lang": "es", "value": "Los m\u00e9todos de consulta de repositorio de Spring Data MongoDB anotados con @Query que utilizan el enlace de par\u00e1metros regex realizan una validaci\u00f3n insuficiente del par\u00e1metro enlazado. Un atacante puede proporcionar una cadena manipulada para escapar de la comilla de expresi\u00f3n regular prevista.\n\nVersiones afectadas:\nSpring Data MongoDB 5.0.0 hasta 5.0.5; 4.5.0 hasta 4.5.11; 4.4.0 hasta 4.4.14; 4.3.0 hasta 4.3.16; 4.2.0 hasta 4.2.15; 4.1.0 hasta 4.1.14; 4.0.0 hasta 4.0.15; 3.4.0 hasta 3.4.19."}], "id": "CVE-2026-41696", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41696", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T17:52:05.245642Z", "version": "2.0.3"}}]}, "published": "2026-06-10T00:16:50.800", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-41696"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security@vmware.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.springframework.data/spring-data-mongodb: Spring Data MongoDB: Information disclosure via insufficient regex parameter validation", "id": "2487396", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487396"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-624", "details": ["Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.", "A flaw was found in Spring Data MongoDB. Repository query methods that use regular expression (regex) parameter binding perform insufficient validation of the bound parameter. A remote attacker can exploit this by supplying a crafted string, which could lead to breaking out of the intended regular expression quoting. This vulnerability can result in information disclosure."], "name": "CVE-2026-41696", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "spring-data-mongodb", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "spring-data-mongodb", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-06-09T23:47:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41696\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41696\nhttps://spring.io/security/cve-2026-41696"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.5.0,4.5.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.20)"}}], "original": {"product": "Spring Data MongoDB", "source": "cna", "vendor": "Spring"}, "product": "spring_data_mongodb", "vendor": "spring"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.5.0,4.5.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.20)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "Spring Data MongoDB", "source": "cna", "vendor": "Spring"}, "product": "spring_data_mongodb", "vendor": "vmware"}], "created": "2026-06-10T01:30:18.172628+00:00", "updated": "2026-06-29T14:00:05.030034+00:00", "vendors": ["spring", "spring$PRODUCT$spring_data_mongodb", "vmware", "vmware$PRODUCT$spring_data_mongodb"]}