CVE-2026-41728: Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

Q: What is the severity of CVE-2026-41728?

The severity of CVE-2026-41728 is rated high, with a score of 7.5.

Q: How do I fix CVE-2026-41728?

To fix CVE-2026-41728, upgrade to Spring Data REST version 3.7.20, 4.3.17, 4.4.15, or 4.5.1 or later.

Q: What versions are affected by CVE-2026-41728?

Affected versions of Spring Data REST include 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, and 4.5.0 through 4.5.0.

Q: What type of vulnerability is CVE-2026-41728?

CVE-2026-41728 is a security vulnerability that allows a bypass of Jackson read-only property protection on nested objects and collections.

Q: What impact does CVE-2026-41728 have on applications?

The impact of CVE-2026-41728 can lead to unintended modifications of read-only properties in applications using Spring Data REST.

Published Jun 9, 2026

Updated

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

Affected Software

6 affected components

maven/org.springframework.data/spring-data-rest>=3.7.0<=3.7.19, >=4.3.0<=4.3.16, >=4.4.0<=4.4.14, >=4.5.0<=4.5.11, >=5.0.0<=5.0.5

VMware Spring Data REST>=3.7.0<3.7.20

VMware Spring Data REST>=4.3.0<4.3.17

VMware Spring Data REST>=4.4.0<4.4.15

VMware Spring Data REST>=4.5.0<4.5.11.1

VMware Spring Data REST>=5.0.0<5.0.5.1

Event History

Jun 9, 2026

CVE Published

via MITRE·11:49 PM

Data Sourced

via MITRE·11:49 PM

DescriptionSeverityWeakness

Jun 10, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-41728?

The severity of CVE-2026-41728 is rated high, with a score of 7.5.

How do I fix CVE-2026-41728?

To fix CVE-2026-41728, upgrade to Spring Data REST version 3.7.20, 4.3.17, 4.4.15, or 4.5.1 or later.

What versions are affected by CVE-2026-41728?

Affected versions of Spring Data REST include 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, and 4.5.0 through 4.5.0.

What type of vulnerability is CVE-2026-41728?

CVE-2026-41728 is a security vulnerability that allows a bypass of Jackson read-only property protection on nested objects and collections.

What impact does CVE-2026-41728 have on applications?