Executive brief
Spring Data KeyValue and Spring Data Redis are components used by Java applications to manage data in key-value stores like Redis. A security vulnerability in these components could allow an attacker to execute unauthorized commands on the server. This could lead to the theft of sensitive data, disruption of services, or full system compromise if an application processes untrusted sorting parameters from users.
Technical details
A SpEL (Spring Expression Language) Injection vulnerability exists in Spring Data KeyValue and Spring Data Redis. The root cause is the SpelPropertyComparator component, which evaluates sorting criteria using SpEL without sufficient sanitization. An attacker with low privileges can exploit this over the network by providing a malicious SpEL expression as a 'Sort' parameter in a repository query method. Successful exploitation allows for remote code execution (RCE) in the context of the application. The vulnerability is mitigated by high attack complexity, likely due to the specific application configuration required to expose the vulnerable query methods to user input. Patches are available in versions 4.0.6 and 3.5.12.
Affected products
- Spring Spring Data KeyValue 4.0.0 - 4.0.5, 3.5.0 - 3.5.11, 3.4.0 - 3.4.14, 3.3.0 - 3.3.16, 3.2.0 - 3.2.15, 3.1.0 - 3.1.14, 3.0.0 - 3.0.15, 2.7.0 - 2.7.19
- Spring Spring Data Redis 4.0.0 - 4.0.5, 3.5.0 - 3.5.11, 3.4.0 - 3.4.14, 3.3.0 - 3.3.16, 3.2.0 - 3.2.15, 3.1.0 - 3.1.14, 3.0.0 - 3.0.15, 2.7.0 - 2.7.19
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched: Advisory updated with patch information