CVE-2026-47834

Received Received - Intake

Sort Validation Bypass in Spring Data JPA

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VMware

Description

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-47834

Affected Vendors & Products

Vendor	Product	Version / Range
spring_project	spring_data_jpa	4.1.0
spring_project	spring_data_jpa	From 4.0.0 (inc) to 4.0.6 (inc)
spring_project	spring_data_jpa	From 3.5.0 (inc) to 3.5.13 (inc)
spring_project	spring_data_jpa	From 3.0.0 (inc) to 3.4.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves Spring Data JPA's Sort validation being bypassed when crafted payloads are accepted from untrusted sources. This could allow attackers to manipulate sorting operations in ways not intended by the application.

Detection Guidance

This vulnerability involves bypassing Sort validation in Spring Data JPA when crafted payloads are accepted from untrusted sources. Detection requires checking for unusual Sort parameter inputs in application logs or network traffic that may indicate attempts to exploit this issue.

Impact Analysis

An attacker could exploit this to perform unauthorized sorting operations, potentially accessing or manipulating data in unintended ways. This may lead to information disclosure or data integrity issues depending on the application's use of Sort.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, which may violate compliance requirements for data protection and integrity such as GDPR or HIPAA. Unauthorized access to sensitive data could result in regulatory penalties.

Mitigation Strategies

Upgrade Spring Data JPA to a version not affected by this vulnerability. Affected versions include 3.0.0-3.4.15, 3.5.0-3.5.13, 4.0.0-4.0.6, and 4.1.0. Apply the latest patches from the vendor.

Hi! I’m here to help you understand CVE-2026-47834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70