CVE-2026-41719: Spring Data KeyValue & Redis SpEL Injection

Technical summary

CVE-2026-41719 is a SpEL injection flaw in Spring Data KeyValue and Spring Data Redis. The vulnerability stems from insufficient input validation in the SpelPropertyComparator class, which is used when repository query methods delegate sort operations. When a Sort object containing user-controlled data is passed to a query method without sanitization, the SpEL parser evaluates arbitrary expressions embedded in the sort parameter. Because SpEL provides access to Java object methods, an attacker can craft payloads to invoke arbitrary code execution within the application's JVM context. The vulnerability requires authentication (PR:L in the CVSS vector), meaning the attacker must have valid credentials to the application or API. The complexity is high (AC:H), suggesting exploitation may require specific application configuration or interaction patterns, but the scope remains unchanged and impact includes confidentiality, integrity, and availability concerns.

Business impact

Organizations using affected Spring Data KeyValue or Spring Data Redis versions face a risk of unauthorized data access and potential system compromise by authenticated users or compromised accounts. In multi-tenant environments, this could lead to cross-tenant data leakage. The vulnerability is particularly concerning for applications that accept user-provided sort parameters in public APIs or administrative interfaces. Depending on deployment context, exploitation could enable data exfiltration, modification of application state, or denial of service. However, the requirement for authentication and the high complexity barrier limit the population of viable attackers to those with legitimate system access or valid credentials.

Affected systems

Spring Data KeyValue versions 2.7.0 through 2.7.19, 3.0.0 through 3.0.15, 3.1.0 through 3.1.14, 3.2.0 through 3.2.15, 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5 are affected. Spring Data Redis—which shares the vulnerable code path—is affected across the same version ranges. Applications using these libraries are at risk if they accept end-user input for sort operations without additional validation. Both stable and recent versions are affected; patched versions have not yet been provided in the published advisory data, so verification against vendor releases is essential.

Exploitability

Exploitation requires an authenticated user with network access to the application (AV:N). The attacker must craft a malicious Sort parameter and pass it to a repository query method in a way that triggers the vulnerable SpelPropertyComparator. The high complexity factor (AC:H) suggests that successful exploitation may depend on specific application configurations, API design choices, or Java runtime settings. The authentication requirement significantly reduces opportunistic risk, but insider threats, compromised service accounts, or valid users with malicious intent represent realistic attack vectors. Public exploit code or automated scanners are not widely available, which elevates the bar for opportunistic attackers but does not preclude sophisticated adversaries from reverse-engineering payloads. This is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

The primary remediation is to update Spring Data KeyValue and Spring Data Redis to patched versions as released by Broadcom/VMware. Verify the specific patched version numbers against the official Spring Data project releases and security advisories. Until patches are applied, organizations should: (1) restrict access to query APIs that accept user-provided sort parameters, particularly in production environments; (2) implement input validation to reject sort parameters containing suspicious characters or SpEL syntax (brackets, curly braces, hash symbols); (3) use Spring Data query methods that do not expose Sort objects to untrusted input; (4) apply principle of least privilege to service accounts and API credentials to limit blast radius if an account is compromised.

Patch guidance

Monitor the official Broadcom/VMware Spring Data project release notes and security advisories for patched versions addressing CVE-2026-41719. Apply patches promptly to development and staging environments first to validate compatibility with your application. Pay close attention to the affected version ranges (2.7.x, 3.x, and 4.0.x lines) to identify which releases require updates. Test query functionality and sort operations after patching to ensure no regression. Coordinate patch deployment with change management and release schedules to minimize operational disruption. Backports may be available for older stable branches; consult the vendor advisory to determine which version lines will receive updates.

Detection guidance

Monitor application logs for suspicious sort parameters containing SpEL syntax patterns: use cases, hash symbols (#), square brackets, curly braces, or method invocation patterns (e.g., T(java.lang.Runtime)). Implement Web Application Firewall (WAF) rules to block HTTP requests with SpEL injection patterns in query parameters. Use runtime application self-protection (RASP) or Java agents to intercept and log SpEL evaluation attempts. Monitor for unusual CPU or memory spikes that might indicate code execution. In Java applications, enable Spring Security debug logging to capture authentication and authorization events. Review repository query method calls to identify which endpoints accept user-provided Sort objects; those are the highest-risk attack surfaces. Correlate authentication logs with API request patterns to identify potential exploitation attempts by authenticated users.

Why prioritize this

This vulnerability warrants prompt but measured attention. The CVSS score of 6.4 (MEDIUM) reflects material risk to confidentiality and integrity, but the authentication requirement and high complexity barrier reduce immediate exploitation likelihood. Prioritize patching if your organization: uses Spring Data KeyValue or Redis in customer-facing or multi-tenant applications; exposes sort APIs to end-users without additional validation; runs versions 3.x or 4.0.x (more recent, actively used); or operates in regulated industries (finance, healthcare) where data confidentiality is critical. Organizations with mature input validation, strong authentication controls, and network segmentation can afford a measured timeline, but should not defer indefinitely.

Risk score, explained

The CVSS 6.4 score reflects a medium-severity vulnerability with significant but not critical impact. Network accessibility (AV:N) is typical for web and API-based applications. The authentication requirement (PR:L) and high complexity (AC:H) meaningfully reduce the attack surface and likelihood of exploitation compared to an unauthenticated or low-complexity flaw. The impact on confidentiality (HIGH), integrity (LOW), and availability (LOW) indicate that data theft is the primary concern, with secondary risks to system modification or availability. The unchanged scope (S:U) means the vulnerability is confined to the affected component and does not escalate to other systems by design, though downstream impacts depend on application architecture.

Frequently asked questions