Spring Spring Data Rest
4 CVEs affecting Spring Spring Data Rest. Latest disclosed: 2026-06-10. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41729 | High | 8.1 | 2026-06-10 | Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. Whe… |
CVE-2026-41728 | High | 7.5 | 2026-06-10 | Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving… |
CVE-2026-41837 | Medium | 5.3 | 2026-06-10 | Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizatio… |
CVE-2026-41730 | Medium | 5.3 | 2026-06-10 | Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. … |