4.8
Medium
CVE-2026-47834 Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted…
Description
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Data JPA | 4.1.0 | No fix stated |
| Spring Data JPA 4.0 | 4.0.0 → 4.0.6 | No fix stated |
| Spring Data JPA 3.5 | 3.5.0 → 3.5.13 | No fix stated |
| Spring Data JPA 3.0 | 3.0.0 → 3.4.15 | No fix stated |