CVE-2026-47834

MediumCVSS 6.5/10Last modified Sep 4, 2026

Description

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2026
Last modified
Sep 4, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-478357.5In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GCVE-2026-478368.1The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptibCVE-2026-478379.8Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config ServCVE-2026-478388.1SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrongCVE-2026-478399.2A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting thCVE-2026-47849.8A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of theCVE-2026-478407.5A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, thCVE-2026-478417.4An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session CVE-2026-478426.5Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode enCVE-2026-478433.7In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previouslCVE-2026-478443.7In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the CVE-2026-478455.3In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order f