CVE-2026-47834

Overview

Spring Data JPA is the Spring Data module for JPA based data access. It builds repository implementations from plain interface declarations, derives queries from method names, supports JPQL and native SQL statements through the @Query annotation, and layers pagination and sorting on top of any JPA provider such as Hibernate or EclipseLink.

An Information Exposure vulnerability (CVE-2026-47834) has been identified in the Sort expression validation applied when repository results are ordered, which allows attackers who control the sort parameters of a native SQL repository method to place crafted expressions into the generated ORDER BY clause and infer characteristics of data they are not authorized to read.

Per CWE: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

This issue affects native SQL repository methods of Spring Data JPA that accept Sort or Pageable values derived from untrusted input.

‍

Details

Module Info

• Product: Spring Data JPA
• Affected packages: org.springframework.data:spring-data-jpa
• Affected versions: <=2.7.18, >=3.0.0 <=3.4.15, >=3.5.0 <=3.5.13, >=4.0.0 <=4.0.6, 4.1.0
• GitHub repository: https://github.com/spring-projects/spring-data-jpa
• Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-jpa
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Data JPA 2.5.12-spring-data-jpa-2.5.17, 2.7.18-spring-data-jpa-2.7.28, 3.2.12-spring-data-jpa-3.2.20, 3.3.13-spring-data-jpa-3.3.18, 3.4.13-spring-data-jpa-3.4.18 and 3.5.13-spring-data-jpa-3.5.15
  • OSS Spring Data JPA 4.0.7 and 4.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.data:spring-data-jpa package in the sort handling of repository query methods of Spring Data JPA.

When a repository method declares a Sort or Pageable parameter, the requested order properties are appended to the query text before it is handed to the persistence provider. Each property first passes through QueryUtils.checkSortExpression, which is meant to reject anything that is not a plain property reference:

private static final Pattern PUNCTATION_PATTERN = compile(".*((?![._])[\p{Punct}|\s])");

public static void checkSortExpression(Order order) {

    if (order instanceof JpaOrder jpaOrder && jpaOrder.isUnsafe()) {
        return;
    }

    if (PUNCTATION_PATTERN.matcher(order.getProperty()).find()) {
        throw new InvalidDataAccessApiUsageException(String.format(UNSAFE_PROPERTY_REFERENCE, order));
    }
}

The guard is a deny list built from the \p{Punct} and \s character classes. Compiled without the UNICODE_CHARACTER_CLASS flag, both classes match ASCII characters only, so non-ASCII punctuation, symbols and invisible formatting characters are treated as ordinary property text and pass validation. Fullwidth parentheses and comparison signs (U+FF08, U+FF09, U+FF1C, U+FF1D), the Unicode minus sign (U+2212), the no break space (U+00A0), the zero width space (U+200B), line and paragraph separators (U+2028 and U+2029), the word joiner (U+2060), the byte order mark (U+FEFF) and the pop directional formatting character (U+202C) all survive the check.

An application is exploitable when it accepts Sort or Pageable values from untrusted input and passes them without sanitization to a repository method annotated with @NativeQuery or @Query(nativeQuery = true), and the underlying database accepts non-ASCII characters as part of its SQL syntax. In that case the accepted property is interpolated verbatim into the ORDER BY clause of the native statement, and an attacker can shape the ordering into a boolean oracle that reveals characteristics of rows the application never intended to expose. The advisory scopes exploitation to methods executing native SQL; expressions a developer opts into through JpaSort.unsafe bypass the check by design and are outside the scope of this issue.

Before 3.2.9, 3.3.3, 3.4.0 and 3.5.0, a native query method could declare a Sort parameter only when its query text contained a #sort placeholder, and a plain native query method with a Sort parameter was rejected outright, so on those lines the issue is reachable only through native queries that carry that placeholder.

‍

Mitigation

Only recent versions of Spring Data JPA receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Data JPA.
• Reject or normalize Sort and Pageable values built from untrusted input before they reach a native query repository method, allowing only known property names.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• SharlongWen (finder)