CVE-2026-41719

Overview

Spring Data KeyValue is a module of the Spring Data project that provides repository and template abstractions over simple key/value stores, including the in-memory Map-based store and Redis through Spring Data Redis.

A medium-severity vulnerability (CVE-2026-41719) has been identified in Spring Data KeyValue. The SpelPropertyComparator used to sort query results builds a Spring Expression Language (SpEL) expression by interpolating the requested sort property name directly into the expression text. When an application passes an unsanitized, user-controlled Sort value into a repository query method, an attacker can inject a crafted property name that is parsed and evaluated as SpEL, leading to expression injection.

Per OWASP, code injection occurs when an application passes untrusted data into an interpreter as part of a command or expression, allowing the attacker to alter the intended logic of the program.

This issue affects versions >=2.5.0 <=2.5.12, >=2.7.0 <=2.7.19, >=3.0.0 <=3.0.15, >=3.1.0 <=3.1.14, >=3.2.0 <=3.2.15, >=3.3.0 <=3.3.16, >=3.4.0 <=3.4.14, >=3.5.0 <=3.5.11, and >=4.0.0 <=4.0.5 of Spring Data KeyValue.

‍

Details

Module Info

• Product: Spring Data KeyValue
• Affected packages: spring-data-keyvalue
• Affected versions: >=2.5.0 <=2.5.12, >=2.7.0 <=2.7.19, >=3.0.0 <=3.0.15, >=3.1.0 <=3.1.14, >=3.2.0 <=3.2.15, >=3.3.0 <=3.3.16, >=3.4.0 <=3.4.14, >=3.5.0 <=3.5.11, >=4.0.0 <=4.0.5
• GitHub repository: https://github.com/spring-projects/spring-data-keyvalue
• Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-keyvalue
• Package manager: maven
• Fixed in:
• NES for Spring Data KeyValue
• Spring Data KeyValue 4.0.6, 3.5.12 (OSS)

Vulnerability Info

When sorting query results, Spring Data KeyValue resolves each Sort order into a SpelPropertyComparator, passing the order's property name as the comparison path. The comparator constructs a SpEL expression by interpolating that path directly into the expression string and then parsing it:

protected String buildExpressionForPath() {
    return String.format("#comparator.compare(#arg1?.%s,#arg2?.%s)",
        path.replace(".", "?."), path.replace(".", "?."));
}

Because the property name is concatenated into the expression text without escaping or validation, a request that controls the Sort property can supply a value that is no longer a simple property path but additional SpEL. The expression is then evaluated against an evaluation context that permits property navigation and instance-method invocation, so the injected expression executes within the application. On the 2.x lines the comparator evaluates the expression under SpEL's default, unrestricted evaluation context, which additionally exposes constructors and type references and makes the injection more powerful on those versions.

Exploitation requires an application that sorts via SpelPropertyComparator, exposes the affected query method to untrusted callers (for example through a custom REST endpoint), and passes the caller's input into that method as a Sort without validation. An attacker meeting those conditions can influence the evaluated expression to read application state and invoke methods reachable from the evaluation context. The remediation restricts the comparator to plain property navigation and evaluates it in a read-only evaluation context, so method invocation, type references, and constructors are no longer reachable from a crafted property name.

This vulnerability has been present since the earliest Spring Data KeyValue 1.x releases (2014).

‍

Mitigation

Spring Data KeyValue versions in the affected range are End-of-Life from a community-support standpoint and will not receive further open-source security updates on the older lines.

Recommended actions:

1. Upgrade to a supported, fixed version of Spring Data KeyValue (4.0.6 or 3.5.12 or later).
2. For applications that must remain on an End-of-Life line, HeroDevs Never-Ending Support (NES) provides a drop-in patched build of Spring Data KeyValue that closes this vulnerability. Learn more about HeroDevs Never-Ending Support for Spring Data KeyValue and request coverage at https://www.herodevs.com/support/spring-nes

‍

Credits

• Not disclosed.