Advisoriesby IbisVMwareCVE-2026-47834
Spring Data JPA's Sort validation can be bypassed
No fix yet
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.
Spring Data JPA 4.1.0
Spring Data JPA 4.0.0 - 4.0.6
Spring Data JPA 3.5.0 - 3.5.13
Spring Data JPA 3.0.0 - 3.4.15
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Spring Data JPA Product | <= 4.1.0 | No fix yet |
| >= 4.0.0, <= 4.0.6 | No fix yet | |
| >= 3.5.0, <= 3.5.13 | No fix yet | |
| >= 3.0.0, <= 3.4.15 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
- Severity from
- the vendor (its own CVE record or advisory)