Executive brief
Spring Data JPA is a widely-used library that simplifies database queries in Java applications. This vulnerability allows an attacker to bypass input validation on sorting parameters by sending specially-crafted requests, potentially leading to unauthorized data access or manipulation. Applications using Spring Data JPA are at risk if they accept untrusted sort parameters from users.
Technical details
This is a validation bypass vulnerability in Spring Data JPA's Sort parameter handling. The vulnerability occurs when applications accept untrusted sort parameters from external sources and fail to properly validate them before processing. An attacker can craft malicious sort parameters that circumvent validation checks, potentially leading to SQL injection, information disclosure, or unauthorized data access depending on how the sorting is implemented. The vulnerability affects multiple versions: 4.1.0, 4.0.0–4.0.6, 3.5.0–3.5.13, and 3.0.0–3.4.15. The attack requires network access and the ability to submit custom sort parameters to the application.
Affected products
- VMware Spring Data JPA 3.0.0 to 3.4.15, 3.5.0 to 3.5.13, 4.0.0 to 4.0.6, 4.1.0
Timeline
- 2026-08-26: disclosed