What is CVE-2026-47834?

CVE-2026-47834 is a medium-severity vulnerability in Spring Data Jpa, classified under CWE-89 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION'). CVSS score: 4.8/10. Published 2026-08-26.

How severe is CVE-2026-47834?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Vulnerability in Spring Data Jpa

CVE-2026-47834

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L.

Affected products

Spring Data Jpa — versions 4.1.0

References

security@vmware.com

Frequently asked questions

What is CVE-2026-47834?: CVE-2026-47834 is a medium-severity vulnerability in Spring Data Jpa, classified under CWE-89 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION'). CVSS score: 4.8/10. Published 2026-08-26.
How severe is CVE-2026-47834?: Medium severity. CVSS v3 base score is 4.8 out of 10.