CVE-2026-47834

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47834

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47834.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47834

Published

2026-08-26T19:22:22.873Z

Modified

2026-09-06T03:46:00.674325266Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator

Summary

Spring Data JPA Sort expression validation bypass

Details

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15

Database specific

{
    "cna_assigner": "vmware",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.0"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.6"
                },
                {
                    "introduced": "3.5.0"
                },
                {
                    "last_affected": "3.5.13"
                },
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.4.15"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47834.json"
}

References

Affected packages

Git / github.com/spring-projects/spring-data-jpa

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-data-jpa

Events

Introduced

bfd959818e25c1e24c1892e29e8acc653366d8d8

Fixed

0eca2377365023828674777f28ac46e14e950001

Database specific

Show details

{
    "cpe": "cpe:2.3:a:vmware:spring_data_jpa:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.0.1"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47834.json"