medium4.8
CVE-2026-47834
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.
Impact
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Data Jpa | from 3.0.0 before 3.4.16 from 3.5.0 before 3.5.14 from 4.0.0 before 4.0.6.1 from 4.1.0 before 4.1.0.1 |