Description

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

The application is vulnerable if all conditions below are true:

1. The SpelPropertyComparator is used for sorting.
2. The method is exposed to untrusted input (e.g. via a custom REST endpoint)
3. Unsanitized user input is directly passed to the method.

Affected Spring Products and Versions

Spring Data KeyValue:

• 4.0.0 to 4.0.5
• 3.5.0 to 3.5.11
• 3.4.0 to 3.4.14
• 3.3.0 to 3.3.16
• 3.2.0 to 3.2.15
• 3.1.0 to 3.1.14
• 3.0.0 to 3.0.15
• 2.7.0 to 2.7.19
• older unsupported versions

Spring Data Redis (through Spring Data KeyValue):

• 4.0.0 to 4.0.5
• 3.5.0 to 3.5.11
• 3.4.0 to 3.4.14
• 3.3.0 to 3.3.16
• 3.2.0 to 3.2.15
• 3.1.0 to 3.1.14
• 3.0.0 to 3.0.15
• 2.7.0 to 2.7.19
• older unsupported versions

Mitigation

Users of affected versions should upgrade to the corresponding fixed version of Spring Data KeyValue.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L&version=3.1

History

• 2026-06-09: Initial vulnerability report published.