SB20260828171 - Input validation error in Spring Data JPA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260828171

SB20260828171 - Input validation error in Spring Data JPA

Published: August 28, 2026

Security Bulletin ID SB20260828171
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2026-47834)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper input validation in Sort validation for native SQL repository methods when processing crafted Sort parameters from untrusted input. A remote attacker can supply crafted Sort or Pageable parameters to disclose sensitive information and cause a denial of service.

The issue is exposed only when sorting is enabled on repository methods using native queries and the underlying database accepts non ASCII characters as part of its SQL syntax.


Remediation

Install update from vendor's website.

References