CVE-2026-41697 affects Spring Data Relational components (including JDBC and R2DBC) in versions 2.4.0 through 4.0.5. The issue arises because the framework does not properly escape binding values when using StringMatcher options (STARTING, ENDING, or CONTAINING) in Query By Example queries. This improper neutralization of special elements in data query logic enables an attacker to inject wildcard characters, facilitating boolean-based blind data inference attacks. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and availability impact.

An attacker can exploit this vulnerability to perform boolean-based blind data inference by injecting wildcard characters into query bindings. This may lead to limited unauthorized information disclosure (confidentiality impact) and minor disruption of service (availability impact). There is no indication of integrity impact or remote code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Spring's official advisories for updates. Until a patch is available, avoid using StringMatcher with externally-controlled input in Query By Example or implement additional input validation and sanitization to mitigate injection of wildcard characters.