Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework.data:spring-data-mongodb

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

    CVE-2026-41717 · GHSA-5whc-4q84-fj73

    Affected
    • Maven org.springframework.data:spring-data-mongodb >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.0.0, <= 4.3.16; <= 3.4.19
    Fixed in
    4.5.125.0.6· Partial vendor fix
    Issue
    Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

    Recommended action: Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.9MavenPublished

    Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

    CVE-2026-41696 · GHSA-hc43-m36c-8v33

    Affected
    • Maven org.springframework.data:spring-data-mongodb >= 5.0.0, <= 5.0.5; >= 4.5.0, <= 4.5.11; >= 4.4.0, <= 4.4.14; >= 4.0.0, <= 4.3.16; <= 3.4.19
    Fixed in
    4.5.125.0.6· Partial vendor fix
    Issue
    Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

    Recommended action: Upgrade to 5.0.6 or 4.5.12 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. Critical, CVSS 9.0MavenPublished

    SpEL Injection in Spring Data MongoDB

    CVE-2022-22980 · GHSA-w24x-87mr-4r23

    Affected
    • Maven org.springframework.data:spring-data-mongodb >= 3.4.0, <= 3.4.0; < 3.3.5
    Fixed in
    3.4.13.3.5· Vendor fix available
    Issue
    A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

    Recommended action: Upgrade to 3.4.1 or 3.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →