Skip to content
OpenAdvisories

Package · Maven

org.springframework.data:spring-data-rest-core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-41729 Public exploit

    Spring Data REST SpEL Injection via Map Key in JSON Patch

    Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map ke…

    Spring Spring Data REST org.springframework.data:spring-data-rest-core Maven
  • High 7.5
    CVE-2026-41728

    Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

    Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 throug…

    Spring Spring Data REST org.springframework.data:spring-data-rest-core Maven