Spring Data REST vulnerabilities

Latest Spring Data REST CVEs

Newest publication first

1. CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

   Published 2026-08-27

   High·CVSS 7.1 EPSS 0.35%

   Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.1...

2. CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

   Published 2026-08-26

   Medium·CVSS 4.3 EPSS 0.31%

   Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spri...

3. CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

   Published 2026-06-09

   Medium·CVSS 5.3 EPSS 0.19%

   Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0...

4. CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

   Published 2026-06-09

   Medium·CVSS 5.3 EPSS 0.20%

   Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11...

5. CVE-2026-41729 Spring Data REST SpEL Injection via Map Key in JSON Patch

   Published 2026-06-09

   High·CVSS 8.1 EPSS 0.41%

   Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directl...

6. CVE-2026-41728 Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

   Published 2026-06-09

   High·CVSS 7.5 EPSS 0.31%

   Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 throu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.