org.springframework.data:spring-data-rest-core

2 results · Clear filters · Feed

• High 8.1
  CVE-2026-41729 Public exploit

  Spring Data REST SpEL Injection via Map Key in JSON Patch

  Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map ke…

  Spring Spring Data REST org.springframework.data:spring-data-rest-core Maven
  Jun 9, 2026
• Critical 9.8
  CVE-2017-8046 Public exploit EPSS 75%

  Remote code execution in PATCH requests in Spring Data REST

  Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

  Pivotal Pivotal Spring Data REST and Spring Boot org.springframework.data:spring-data-rest-core Maven
  Jan 4, 2018