Description

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding (e.g., @Query("{ name : /^\\Q?0\\E$/ }")) perform insufficient validation of the bound parameter.

An attacker can supply a crafted string to break out of the intended regular expression quoting. When the repository is exposed to untrusted sources (e.g. via spring-data-rest). This can lead to unauthorized data exposure or bypass of intended query filters.

Affected Spring Products and Versions

Spring Data MongoDB:

• 5.0.0 to 5.0.5
• 4.5.0 to 4.5.11
• 4.4.0 to 4.4.14
• 4.3.0 to 4.3.16
• 4.2.0 to 4.2.15
• 4.1.0 to 4.1.14
• 4.0.0 to 4.0.15
• 3.4.0 to 3.4.19
• older unsupported versions

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1

History

• 2026-06-09: Initial vulnerability report published.