CVE-2026-41719: Spring Data KeyValue SpEL Injection Flaw

CVE-2026-41719 Overview

CVE-2026-41719 is a Spring Expression Language (SpEL) injection vulnerability [CWE-917] in Spring Data KeyValue and Spring Data Redis. The flaw exists when unsanitized user input flows into a Sort argument passed to a repository query method that delegates evaluation to SpelPropertyComparator. An attacker who can influence sort parameters can supply a crafted SpEL expression that the comparator evaluates at runtime. Multiple branches are affected, including 4.0.0–4.0.5, 3.5.0–3.5.11, 3.4.0–3.4.14, 3.3.0–3.3.16, 3.2.0–3.2.15, 3.1.0–3.1.14, 3.0.0–3.0.15, and 2.7.0–2.7.19.

Critical Impact
Attackers with low privileges can execute attacker-controlled SpEL expressions on the server, leading to confidential data exposure and tampering of evaluated objects.

Affected Products

Spring Data KeyValue 2.7.0–2.7.19, 3.0.0–3.0.15, 3.1.0–3.1.14, 3.2.0–3.2.15, 3.3.0–3.3.16, 3.4.0–3.4.14, 3.5.0–3.5.11, 4.0.0–4.0.5
Spring Data Redis (same version ranges as above)
Applications exposing repository query methods that accept user-controlled Sort parameters

Discovery Timeline

2026-06-10 - CVE-2026-41719 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41719

Vulnerability Analysis

The vulnerability resides in SpelPropertyComparator, an internal component used by Spring Data KeyValue and Spring Data Redis to order in-memory result sets. When a repository query method receives a Sort object, the comparator constructs a SpEL expression from the requested property name and evaluates it against each entity. If the property name originates from untrusted input without sanitization, the expression parser interprets attacker-supplied syntax as live SpEL rather than a property accessor.

Successful exploitation results in evaluation of arbitrary SpEL within the application context. This grants access to reflective method invocation, allowing the attacker to read or modify objects reachable from the evaluation context. The attack requires network access and low privileges but carries higher attack complexity, since the attacker must reach a code path that forwards external input into a Sort instance.

Root Cause

The root cause is improper neutralization of special elements used in an expression language statement [CWE-917]. SpelPropertyComparator treats the sort property string as a SpEL expression source instead of validating it against a fixed set of known property names. Any framework consumer that wires HTTP query parameters, headers, or request bodies directly into Sort.by(...) extends the trust boundary into the SpEL evaluator.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to an endpoint that builds a Spring Data Sort from request parameters and invokes a repository method backed by SpelPropertyComparator. The malicious sort field contains a SpEL payload such as a T(...) type reference or method invocation chain. The framework parses and evaluates the payload during sorting, returning evaluation side effects to the attacker through application responses or persistent state changes. Refer to the Spring Security Advisory CVE-2026-41719 for vendor technical details.

Detection Methods for CVE-2026-41719

Indicators of Compromise

HTTP requests containing SpEL syntax such as T(, new , #this, or .getClass() in sort, order, or pagination query parameters
Application logs showing org.springframework.expression.spel.SpelEvaluationException or unexpected EvaluationContext errors tied to repository calls
Outbound network connections initiated by JVM threads executing Spring Data repository methods

Detection Strategies

Inspect web access logs for non-alphanumeric characters in sort parameters bound to Spring Data repositories
Add static analysis rules that flag direct construction of Sort from HttpServletRequest, @RequestParam, or @RequestBody values
Instrument SpelPropertyComparator and SpelExpressionParser to log parsed expressions during testing and pre-production validation

Monitoring Recommendations

Forward Spring Boot application logs and JVM telemetry to a centralized analytics platform and alert on SpEL parse failures correlated with repository invocations
Monitor for new child processes or reflective class loading originating from web application worker threads
Track repository query latency anomalies that may indicate expression evaluation abuse

How to Mitigate CVE-2026-41719

Immediate Actions Required

Upgrade Spring Data KeyValue and Spring Data Redis to a fixed release within your maintained branch as listed in the Spring Security Advisory CVE-2026-41719
Audit controllers and services that construct Sort objects from external input and replace direct binding with an allowlist of property names
Restrict access to endpoints exposing repository sort parameters until patches are applied

Patch Information

VMware Spring published fixed versions for each supported branch in the advisory. Consumers on 4.0.x should move to 4.0.6 or later, with corresponding fix releases available for the 3.5.x, 3.4.x, 3.3.x, 3.2.x, 3.1.x, 3.0.x, and 2.7.x branches. Verify the resolved version in your dependency tree, including transitive inclusion through Spring Data Redis. The Common Weakness Enumeration classification is [CWE-917]: Improper Neutralization of Special Elements used in an Expression Language Statement.

Workarounds

Validate sort property names against a strict allowlist before constructing Sort instances
Map external sort identifiers to internal property names using a server-side lookup rather than passing strings directly to Sort.by
Disable or remove repository methods that rely on SpelPropertyComparator when user-controlled sorting is not required

bash

# Configuration example: enforce an allowlist when binding sort parameters
ALLOWED_SORT_FIELDS="id,createdAt,updatedAt,name"
# Reject any inbound sort field not present in the allowlist before constructing Sort.by(...)