CVE-2026-47834

About vulnerability

Spring Data JPA’s Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.

The application is vulnerable if all of the following are true:

• The application accepts Sort parameters from untrusted input and uses them without prior sanitization as input for native SQL repository methods.
• The repository method is annotated with @NativeQuery or @Query(nativeQuery=true).
• The repository method allows sorting via a Sort or Pageable parameter.
• The underlying database accepts non ASCII characters as part of its SQL syntax.

On affected databases inference of data characteristics through deterministic sorting is possible.

Affected product:

Spring

Affected packages:

Spring Boot @ 3.1.8 (+1042 more)