Spring Spring Data Rest
6 CVEs affecting Spring Spring Data Rest. Latest disclosed: 2026-08-27. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41729 | High | 8.1 | 2026-06-10 | Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. Whe… |
CVE-2026-41728 | High | 7.5 | 2026-06-10 | Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving… |
CVE-2026-47849 | High | 7.1 | 2026-08-27 | Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) reque… |
CVE-2026-41837 | Medium | 5.3 | 2026-06-10 | Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizatio… |
CVE-2026-41730 | Medium | 5.3 | 2026-06-10 | Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. … |
CVE-2026-47850 | Medium | 4.3 | 2026-08-27 | Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. S… |