4.8Mittel
CVE-2026-47834Spring Data JPA Sort expression validation bypass
Beschreibung
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15
Schwachstellentyp (CWE):
CWE-89
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Spring | Spring Data JPA | 4.1.0, 4.0.0 – ≤ 4.0.6, 3.5.0 – ≤ 3.5.13, 3.0.0 – ≤ 3.4.15 | |
| vmware | spring data jpa | 3.0.0 – < 3.4.16 |
Referenzen und Patches
- https://spring.io/security/cve-2026-47834 Vendor Advisory
CPE-Treffer (NVD) (4)
cpe:2.3:a:vmware:spring_data_jpa:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.4.16cpe:2.3:a:vmware:spring_data_jpa:*:*:*:*:*:*:*:*≥ 3.5.0 < 3.5.14cpe:2.3:a:vmware:spring_data_jpa:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.6.1cpe:2.3:a:vmware:spring_data_jpa:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.1