CVE-2026-41696

Overview

Spring Data MongoDB is the MongoDB module of the Spring Data family, providing object-document mapping and repository abstractions for building MongoDB-backed Spring applications.

A medium-severity vulnerability (CVE-2026-41696) has been identified in Spring Data MongoDB. Repository query methods annotated with @Query that bind a parameter inside a regular expression literal perform insufficient validation of the bound value. An attacker who can supply a crafted value containing the regex quote terminator can break out of the intended literal quoting and inject regular expression syntax, altering which documents the query matches. When the repository is reachable from untrusted input, for example through spring-data-rest, this can lead to unauthorized data exposure or bypass of the intended query filter.

Per OWASP, sensitive information disclosure occurs when an application allows an actor to access data they are not authorized to see. Here, breaking out of the intended literal quoting widens the query so that documents the filter was meant to exclude become reachable to the attacker.

This issue affects versions >=3.2.0 <=3.2.12, >=3.4.0 <=3.4.19, >=4.0.0 <=4.0.15, >=4.1.0 <=4.1.14, >=4.2.0 <=4.2.15, >=4.3.0 <=4.3.16, >=4.4.0 <=4.4.14, >=4.5.0 <=4.5.11, and >=5.0.0 <=5.0.5 of Spring Data MongoDB.

‍

Details

Module Info

• Product: Spring Data MongoDB
• Affected packages: spring-data-mongodb
• Affected versions: >=3.2.0 <=3.2.12, >=3.4.0 <=3.4.19, >=4.0.0 <=4.0.15, >=4.1.0 <=4.1.14, >=4.2.0 <=4.2.15, >=4.3.0 <=4.3.16, >=4.4.0 <=4.4.14, >=4.5.0 <=4.5.11, >=5.0.0 <=5.0.5
• GitHub repository: https://github.com/spring-projects/spring-data-mongodb
• Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-mongodb
• Package manager: Maven
• Fixed in:
• NES for Spring Data MongoDB 3.2.x, 3.4.x, 4.2.x, 4.3.x, 4.4.x
• Spring Data MongoDB 5.0.6, 4.5.12 (OSS)

Vulnerability Info

Spring Data MongoDB allows a repository @Query to embed a bound parameter inside a regular expression literal that is wrapped in the literal-quote markers \Q and \E. The intent is that the bound value is matched literally, so any regular expression metacharacters it contains have no special meaning:

@Query("{ name : /^\Q?0\E$/ }")

The placeholder substitution is performed in ParameterBindingJsonReader, which interpolates the bound value into the pattern string and constructs a BsonRegularExpression from the result. The bound value is not properly escaped before substitution, so if the value itself contains the sequence \E, it terminates the \Q...\E literal quoting early. Anything the attacker places after \E is then interpreted as live regular expression syntax rather than as a literal string.

For example, a method bound with the query above is meant to match a name equal to the supplied string. Supplying a value such as \E.* closes the literal quote and leaves .* as an unanchored wildcard, causing the query to match documents the filter was intended to exclude. By injecting alternation, anchors, or wildcards in this way, an attacker can broaden or redirect the query and access data outside the intended result set.

A related weakness allowed an expression result to be decoded twice through the parameter-binding reader, re-running the binding logic over already-bound output.

This vulnerability has been present since Spring Data MongoDB 2.2.0.

‍

Mitigation

Spring Data MongoDB versions in the affected range that are no longer covered by open-source maintenance are End-of-Life and will not receive security updates from the upstream project. Upstream open-source fixes are available only for the 5.0.x and 4.5.x lines (5.0.6 and 4.5.12); the 4.4.x, 4.3.x, 3.4.x, and 4.0.x through 4.2.x lines have no publicly available fix.

Users should not attempt to patch affected versions themselves. The recommended actions are:

1. Upgrade to a supported, fixed version of Spring Data MongoDB (5.0.6 or 4.5.12 or later).
2. For versions that are End-of-Life or otherwise cannot be upgraded, use HeroDevs Never-Ending Support (NES) for Spring Data MongoDB, which provides a maintained drop-in replacement with this vulnerability remediated. Learn more about HeroDevs Never-Ending Support for Spring Data MongoDB and request coverage at https://www.herodevs.com/support/spring-nes.