CVE-2026-41697 affects Spring Data Relational and related modules (JDBC, R2DBC) in versions 2.4.0 through 4.0.5. The issue arises because the software does not properly escape binding values of externally-controlled input when using StringMatcher options (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). This improper neutralization of special elements in data query logic can be exploited by an attacker who supplies wildcard characters, enabling boolean-based blind data inference attacks. The vulnerability is identified as CWE-943.

An attacker can leverage this vulnerability to perform boolean-based blind data inference by injecting wildcard characters into query inputs. This may lead to unauthorized inference of sensitive data. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should monitor vendor communications for updates and consider restricting or validating input to Query By Example StringMatcher parameters as a precaution.