CVE-2026-41696
MediumAdvisory
Published 10 Jun 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.003
- 18th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 53
- of 17,781 indexed, latest versions
- Container images
- 34
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods
Carried by container images the latest versions of 53 of 17,781 indexed charts deploy, on 34 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-data-mongodbmaven | 1.9.2.RELEASE, 1.10.16.RELEASE, 1.10.23.RELEASE, 2.0.14.RELEASE+21 more | 4.5.12, 5.0.6 | 34 |
- OSV records
- GHSA-hc43-m36c-8v33
Charts affected
53 by stars
Container images carrying it
34 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| codeurjc/ | 9fb4c11e6a49 | spring-data-mongodb | no fix listed | 13 |
| oscarsotosanchez/ | d4d020e9f272 | spring-data-mongodb | no fix listed | 4 |
| jacobalberty/ | 896c0ab82d33 | spring-data-mongodb | no fix listed | 3 |
| pavanelthepu/ | f47658e3b24c | spring-data-mongodb | no fix listed | 3 |
| graviteeio/ | 05fd67a93056 | spring-data-mongodb | no fix listed | 2 |
| graviteeio/ | 27374522cd04 | spring-data-mongodb | no fix listed | 2 |
| hookiesolutions/ | 0629694246ba | spring-data-mongodb | no fix listed | 2 |
| mbentley/ | f4e682274bed | spring-data-mongodb | no fix listed | 2 |
| stakater/ | 954d2be66e95 | spring-data-mongodb | no fix listed | 2 |
| 2martens/ | bd1ba6ab84c9 | spring-data-mongodb | 4.5.12 | 1 |
| 2martens/ | ba2c3040dab0 | spring-data-mongodb | 4.5.12 | 1 |
| apimap/ | ae2b3ab00177 | spring-data-mongodb | no fix listed | 1 |
| bluerange/ | 07c8f73b55df | spring-data-mongodb | no fix listed | 1 |
| cbioportal/ | 08debbd2dbf9 | spring-data-mongodb | 4.5.12 | 1 |
| dellcloud/ | 02fc234353a9 | spring-data-mongodb | no fix listed | 1 |
| fimperato/ | e32920eedd3a | spring-data-mongodb | no fix listed | 1 |
| fimperato/ | 604012b77841 | spring-data-mongodb | no fix listed | 1 |
| fimperato/ | df05c388ea6c | spring-data-mongodb | no fix listed | 1 |
| hugohg34/ | 812a03b3f274 | spring-data-mongodb | no fix listed | 1 |
| jacobalberty/ | 4a3616625dda | spring-data-mongodb | no fix listed | 1 |
| jacobalberty/ | b3edc809a3ff | spring-data-mongodb | no fix listed | 1 |
| lavandadelpatio/ | 94e225a5a6f8 | spring-data-mongodb | no fix listed | 1 |
| lavandadelpatio/ | 92de3c3426d2 | spring-data-mongodb | no fix listed | 1 |
| lavandadelpatio/ | 71f2ccec8c0d | spring-data-mongodb | no fix listed | 1 |
| lavandadelpatio/ | d2cba20aa4d8 | spring-data-mongodb | no fix listed | 1 |
| lavandadelpatio/ | 214eaef5444c | spring-data-mongodb | no fix listed | 1 |
| linuxserver/ | 0ae315a3a456 | spring-data-mongodb | no fix listed | 1 |
| linuxserver/ | ab105cc50322 | spring-data-mongodb | no fix listed | 1 |
| linuxserver/ | b6ce6968ee45 | spring-data-mongodb | 4.5.12 | 1 |
| microcks/ | e3a3e0c67b09 | spring-data-mongodb | no fix listed | 1 |
| richardchesterwood/ | 36c43961214c | spring-data-mongodb | no fix listed | 1 |
| siakhooi/ | f1f4b5b1b870 | spring-data-mongodb | 5.0.6 | 1 |
| slagattollas/ | dc63973dae0d | spring-data-mongodb | no fix listed | 1 |
| thmmniii/ | 5438517d9fc2 | spring-data-mongodb | no fix listed | 1 |