Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-41719: A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort

25
Routine
MEDIUM 6.4UPGRADEUPGRADE

CVE-2026-41719 is a medium-severity flaw (CVSS 6.4) affecting spring data keyvalue, spring data redis. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.4 (Medium)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededLow
User interactionNone
EPSS exploit chance0.2% (top 89%)
CISA exploited listNo
WeaknessCWE-917
Published2026-06-10
Last modified2026-07-23
Publisher (CNA): VMware · Vendor: broadcom

Share: LinkedIn · X · Reddit

Last updated 2026-07-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

broadcom spring data keyvalue UPGRADE
Affected: >= 2.7.0 and < 2.7.20 · >= 3.0.0 and < 3.0.16 · >= 3.1.0 and < 3.1.15 · >= 3.2.0 and < 3.2.16 · >= 3.3.0 and < 3.3.17 · >= 3.4.0 and < 3.4.15 · >= 3.5.0 and < 3.5.11.1 · >= 4.0.0 and < 4.0.5.1
Fixed in: 2.7.20, 3.0.16, 3.1.15, 3.2.16, 3.3.17, 3.4.15, 3.5.11.1, 4.0.5.1
Safe to downgrade to: a release before 2.7.0
1. Check installed version
apt-cache policy spring-data-keyvalue || rpm -q spring-data-keyvalue || spring-data-keyvalue --version
2. UPGRADE to 2.7.20 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade spring-data-keyvalue
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade spring-data-keyvalue
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.7.0 (Debian / Ubuntu)
apt-cache madison spring-data-keyvalue sudo apt install spring-data-keyvalue=<VERSION_BEFORE_2.7.0> sudo apt-mark hold spring-data-keyvalue
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list spring-data-keyvalue sudo dnf downgrade spring-data-keyvalue-<VERSION_BEFORE_2.7.0> sudo dnf versionlock add spring-data-keyvalue
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom spring data redis UPGRADE
Affected: >= 2.7.0 and < 2.7.20 · >= 3.0.0 and < 3.0.16 · >= 3.1.0 and < 3.1.15 · >= 3.2.0 and < 3.2.16 · >= 3.3.0 and < 3.3.17 · >= 3.4.0 and < 3.4.15 · >= 3.5.0 and < 3.5.11.1 · >= 4.0.0 and < 4.0.5.1
Fixed in: 2.7.20, 3.0.16, 3.1.15, 3.2.16, 3.3.17, 3.4.15, 3.5.11.1, 4.0.5.1
Safe to downgrade to: a release before 2.7.0
1. Check installed version
apt-cache policy spring-data-redis || rpm -q spring-data-redis || spring-data-redis --version
2. UPGRADE to 2.7.20 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade spring-data-redis
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade spring-data-redis
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.7.0 (Debian / Ubuntu)
apt-cache madison spring-data-redis sudo apt install spring-data-redis=<VERSION_BEFORE_2.7.0> sudo apt-mark hold spring-data-redis
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list spring-data-redis sudo dnf downgrade spring-data-redis-<VERSION_BEFORE_2.7.0> sudo dnf versionlock add spring-data-redis
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-41719?

spring data keyvalue: upgrade to 2.7.20, 3.0.16, 3.1.15, 3.2.16, 3.3.17, 3.4.15, 3.5.11.1, 4.0.5.1; spring data redis: upgrade to 2.7.20, 3.0.16, 3.1.15, 3.2.16, 3.3.17, 3.4.15, 3.5.11.1, 4.0.5.1. Exact commands for each OS are on this page.

Is CVE-2026-41719 being exploited?

CVE-2026-41719 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-41719 affect?

CVE-2026-41719 affects spring data keyvalue, spring data redis. Severity is medium (CVSS 6.4). A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue /

How urgent is CVE-2026-41719?

Priority 25/100. No elevated risk signals yet.

Software pages

Redis vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.