Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

5 vulnerabilities found for Spring Data MongoDB by Spring

CVE-2026-41717 (GCVE-0-2026-41717)

Vulnerability from nvd – Published: 2026-06-09 23:48 – Updated: 2026-06-10 12:51
VLAI
Title
Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
Summary
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data MongoDB Affected: 5.0.0 , < 5.0.6 (custom)
Affected: 4.5.0 , < 4.5.12 (custom)
Affected: 4.4.0 , < 4.4.15 (custom)
Affected: 4.3.0 , < 4.3.17 (custom)
Affected: 4.2.0 , < 4.2.16 (custom)
Affected: 4.1.0 , < 4.1.15 (custom)
Affected: 4.0.0 , < 4.0.16 (custom)
Affected: 3.4.0 , < 3.4.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T12:51:45.702081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T12:51:52.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data MongoDB",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "5.0.6",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.15",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.17",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.16",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.15",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.16",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.20",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
            }
          ],
          "value": "Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply unsanitized input to a @Query or @Aggregation repository method using a capture-all placeholder can inject arbitrary SpEL expressions and execute unintended logic."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:48:38.290Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41717"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41717",
    "datePublished": "2026-06-09T23:48:38.290Z",
    "dateReserved": "2026-04-22T06:21:37.020Z",
    "dateUpdated": "2026-06-10T12:51:52.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41696 (GCVE-0-2026-41696)

Vulnerability from nvd – Published: 2026-06-09 23:47 – Updated: 2026-06-10 17:53
VLAI
Title
Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Summary
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data MongoDB Affected: 5.0.0 , < 5.0.6 (custom)
Affected: 4.5.0 , < 4.5.12 (custom)
Affected: 4.4.0 , < 4.4.15 (custom)
Affected: 4.3.0 , < 4.3.17 (custom)
Affected: 4.2.0 , < 4.2.16 (custom)
Affected: 4.1.0 , < 4.1.15 (custom)
Affected: 4.0.0 , < 4.0.16 (custom)
Affected: 3.4.0 , < 3.4.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41696",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T17:52:05.245642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T17:53:14.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data MongoDB",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "5.0.6",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.15",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.17",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.16",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.15",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.16",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.20",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
            }
          ],
          "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply a crafted string to a @Query regex binding can break out of literal quoting, potentially exposing unauthorized data or bypassing intended query filters."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:47:37.883Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41696"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data MongoDB Bind Parameter Literal Quoting Breakout",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41696",
    "datePublished": "2026-06-09T23:47:37.883Z",
    "dateReserved": "2026-04-22T06:21:22.981Z",
    "dateUpdated": "2026-06-10T17:53:14.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-0719

Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Spring Data KeyValue Data KeyValue versions 3.3.x antérieures à 3.3.17
Spring Data REST Data REST versions 4.3.x antérieures à 4.3.17
Spring Spring Data KeyValue Data KeyValue versions 3.4.x antérieures à 3.4.15
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.5.x antérieures à 3.5.12
Spring Spring Data Relational Data Relational versions 3.4.x antérieures à 3.4.15
Spring Spring AMQP AMQP versions 4.0.x antérieures à 4.0.4
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 4.0.x antérieures à 4.0.6
Spring Spring Data MongoDB Data MongoDB versions 3.4.x antérieures à 3.4.20
Spring Spring AMQP AMQP versions antérieures à 4.0.3.1
Spring Spring AMQP AMQP versions antérieures à 3.2.10.1
Spring Spring Data Relational Data Relational versions 3.3.x antérieures à 3.3.17
Spring Spring Data Relational Data Relational versions 4.0.x antérieures à 4.0.6
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.3.x antérieures à 3.3.17
Spring Spring Data KeyValue Data KeyValue versions 3.5.x antérieures à 3.5.12
Spring Spring AMQP AMQP versions 2.4.x antérieures à 2.4.18
Spring Spring Security Security versions 7.0.x antérieures à 7.0.6
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 2.7.x antérieures à 2.7.20
Spring Spring Data MongoDB Data MongoDB versions 4.3.x antérieures à 4.3.17
Spring Spring Security Security versions 1.5.x antérieures à 1.5.8
Spring Spring Security Security versions 6.3.x antérieures à 6.3.17
Spring Spring Data MongoDB Data MongoDB versions 4.5.x antérieures à 4.5.12
Spring Data REST Data REST versions 3.7.x antérieures à 3.7.20
Spring Data REST Data REST versions 4.5.x antérieures à 4.5.12
Spring Data REST Data REST versions 5.0.x antérieures à 5.0.6
Spring Spring Data Relational Data Relational versions 3.5.x antérieures à 3.5.12
Spring Spring AMQP AMQP versions 3.1.x antérieures à 3.1.16
Spring Spring Data Relational Data Relational versions 2.4.x antérieures à 2.4.20
Spring Data REST Data REST versions 4.4.x antérieures à 4.4.15
Spring Spring Security Security versions 5.7.x antérieures à 5.7.24
Spring Spring Data KeyValue Data KeyValue versions 4.0.x antérieures à 4.0.6
Spring Spring Data MongoDB Data MongoDB versions 4.4.x antérieures à 4.4.15
Spring Spring Data KeyValue Data KeyValue versions 2.7.x antérieures à 2.7.20
Spring Spring Security Security versions 6.5.x antérieures à 6.5.11
Spring Spring Data MongoDB Data MongoDB versions 5.0.x antérieures à 5.0.6
Spring Spring AMQP AMQP versions 3.2.x antérieures à 3.2.11
Spring Spring Security Security versions 6.4.x antérieures à 6.4.17
Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.4.x antérieures à 3.4.15
Spring Spring Security Security versions 5.8.x antérieures à 5.8.26
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Data KeyValue versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 3.4.x ant\u00e9rieures \u00e0 3.4.20",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 4.0.3.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions ant\u00e9rieures \u00e0 3.2.10.1",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 2.4.x ant\u00e9rieures \u00e0 2.4.18",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 1.5.x ant\u00e9rieures \u00e0 1.5.8",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.3.x ant\u00e9rieures \u00e0 6.3.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 3.7.x ant\u00e9rieures \u00e0 3.7.20",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.1.x ant\u00e9rieures \u00e0 3.1.16",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Relational versions 2.4.x ant\u00e9rieures \u00e0 2.4.20",
      "product": {
        "name": "Spring Data Relational",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data REST versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Data REST",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.7.x ant\u00e9rieures \u00e0 5.7.24",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data KeyValue versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
      "product": {
        "name": "Spring Data KeyValue",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.11",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data MongoDB versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "Spring Data MongoDB",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "AMQP versions 3.2.x ant\u00e9rieures \u00e0 3.2.11",
      "product": {
        "name": "Spring AMQP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.17",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
      "product": {
        "name": "Spring Data Commons",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 5.8.x ant\u00e9rieures \u00e0 5.8.26",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
    },
    {
      "name": "CVE-2026-40993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40993"
    },
    {
      "name": "CVE-2026-41717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41717"
    },
    {
      "name": "CVE-2026-41721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
    },
    {
      "name": "CVE-2026-41695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
    },
    {
      "name": "CVE-2026-41729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41729"
    },
    {
      "name": "CVE-2026-41719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41719"
    },
    {
      "name": "CVE-2026-41697",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41697"
    },
    {
      "name": "CVE-2026-41008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41008"
    },
    {
      "name": "CVE-2026-41694",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
    },
    {
      "name": "CVE-2026-41696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41696"
    },
    {
      "name": "CVE-2026-41711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
    },
    {
      "name": "CVE-2026-40988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
    },
    {
      "name": "CVE-2026-41003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41003"
    },
    {
      "name": "CVE-2026-41701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41701"
    }
  ],
  "initial_release_date": "2026-06-10T00:00:00",
  "last_revision_date": "2026-06-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0719",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41003",
      "url": "https://spring.io/security/cve-2026-41003"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41696",
      "url": "https://spring.io/security/cve-2026-41696"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41697",
      "url": "https://spring.io/security/cve-2026-41697"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41716",
      "url": "https://spring.io/security/cve-2026-41716"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41721",
      "url": "https://spring.io/security/cve-2026-41721"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41695",
      "url": "https://spring.io/security/cve-2026-41695"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41694",
      "url": "https://spring.io/security/cve-2026-41694"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41711",
      "url": "https://spring.io/security/cve-2026-41711"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41008",
      "url": "https://spring.io/security/cve-2026-41008"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41729",
      "url": "https://spring.io/security/cve-2026-41729"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41701",
      "url": "https://spring.io/security/cve-2026-41701"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40993",
      "url": "https://spring.io/security/cve-2026-40993"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41719",
      "url": "https://spring.io/security/cve-2026-41719"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40988",
      "url": "https://spring.io/security/cve-2026-40988"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41717",
      "url": "https://spring.io/security/cve-2026-41717"
    }
  ]
}

CVE-2026-41717 (GCVE-0-2026-41717)

Vulnerability from cvelistv5 – Published: 2026-06-09 23:48 – Updated: 2026-06-10 12:51
VLAI
Title
Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
Summary
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data MongoDB Affected: 5.0.0 , < 5.0.6 (custom)
Affected: 4.5.0 , < 4.5.12 (custom)
Affected: 4.4.0 , < 4.4.15 (custom)
Affected: 4.3.0 , < 4.3.17 (custom)
Affected: 4.2.0 , < 4.2.16 (custom)
Affected: 4.1.0 , < 4.1.15 (custom)
Affected: 4.0.0 , < 4.0.16 (custom)
Affected: 3.4.0 , < 3.4.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T12:51:45.702081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T12:51:52.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data MongoDB",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "5.0.6",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.15",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.17",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.16",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.15",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.16",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.20",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
            }
          ],
          "value": "Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply unsanitized input to a @Query or @Aggregation repository method using a capture-all placeholder can inject arbitrary SpEL expressions and execute unintended logic."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:48:38.290Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41717"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41717",
    "datePublished": "2026-06-09T23:48:38.290Z",
    "dateReserved": "2026-04-22T06:21:37.020Z",
    "dateUpdated": "2026-06-10T12:51:52.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41696 (GCVE-0-2026-41696)

Vulnerability from cvelistv5 – Published: 2026-06-09 23:47 – Updated: 2026-06-10 17:53
VLAI
Title
Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Summary
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Data MongoDB Affected: 5.0.0 , < 5.0.6 (custom)
Affected: 4.5.0 , < 4.5.12 (custom)
Affected: 4.4.0 , < 4.4.15 (custom)
Affected: 4.3.0 , < 4.3.17 (custom)
Affected: 4.2.0 , < 4.2.16 (custom)
Affected: 4.1.0 , < 4.1.15 (custom)
Affected: 4.0.0 , < 4.0.16 (custom)
Affected: 3.4.0 , < 3.4.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41696",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T17:52:05.245642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T17:53:14.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Data MongoDB",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "5.0.6",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.12",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.15",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.17",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.16",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.15",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.16",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.20",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
            }
          ],
          "value": "Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.\n\nAffected versions:\nSpring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can supply a crafted string to a @Query regex binding can break out of literal quoting, potentially exposing unauthorized data or bypassing intended query filters."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:47:37.883Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41696"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Data MongoDB Bind Parameter Literal Quoting Breakout",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41696",
    "datePublished": "2026-06-09T23:47:37.883Z",
    "dateReserved": "2026-04-22T06:21:22.981Z",
    "dateUpdated": "2026-06-10T17:53:14.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}