Skip to content
OpenAdvisories

Product · Spring

Spring Data REST

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-47849

    Spring Data REST allows mutation of identifier and version properties via JSON Patch

    Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Da…

    Spring Spring Data REST
  • High 8.1
    CVE-2026-41729 Public exploit

    Spring Data REST SpEL Injection via Map Key in JSON Patch

    Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map ke…

    Spring Spring Data REST org.springframework.data:spring-data-rest-core Maven
  • High 7.5
    CVE-2026-41728

    Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

    Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 throug…

    Spring Spring Data REST org.springframework.data:spring-data-rest-core Maven