org.springframework.data:spring-data-jpa

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. Medium, CVSS 5.6MavenPublished 17 May 2022

   Improper Neutralization of Special Elements used in an SQL Command Pivotal Spring Data JPA

   CVE-2016-6652 · GHSA-xr4v-28rm-pvgw

   Affected

   • Maven org.springframework.data:spring-data-jpa < 1.9.6; >= 1.10.0, < 1.10.4

   Fixed in

   1.10.41.9.6· Vendor fix available

   Issue

   SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.

   Recommended action: Upgrade to 1.10.4 or 1.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 16:00 UTCEvidence →
2. Medium, CVSS 5.3MavenPublished 4 Jun 2019

   Improper Neutralization of Wildcards or Matching Symbols

   CVE-2019-3802 · GHSA-xggx-fx6w-v7ch

   Affected

   • Maven org.springframework.data:spring-data-jpa < 1.11.22; >= 2.1.0, < 2.1.8; >= 2.0.0, <= 2.0.14

   Fixed in

   2.1.81.11.22· Vendor fix available

   Issue

   This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

   Recommended action: Upgrade to 2.1.8 or 1.11.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 16:01 UTCEvidence →
3. Medium, CVSS 5.3MavenPublished 14 May 2019

   Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

   CVE-2019-3797 · GHSA-jgmr-wrwx-mgfj

   Affected

   • Maven org.springframework.data:spring-data-jpa < 1.11.20; >= 2.0.0, < 2.0.14; >= 2.1.0, < 2.1.6

   Fixed in

   1.11.202.0.142.1.6· Vendor fix available

   Issue

   This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

   Recommended action: Upgrade to 2.1.6, 2.0.14 or 1.11.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 16:05 UTCEvidence →