CVE-2026-47850: Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Data RESTto a version that resolves this vulnerability.Fixed in 3.7.20 and earlier - Upgrade
Upgrade
Spring Data RESTto a version that resolves this vulnerability.Fixed in 4.0.0 - 4.4.15 - Upgrade
Upgrade
Spring Data RESTto a version that resolves this vulnerability.Fixed in 4.5.0 - 4.5.12 - Upgrade
Upgrade
Spring Data RESTto a version that resolves this vulnerability.Fixed in 5.0.0 - 5.0.6 - Upgrade
Upgrade
Spring Data RESTto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Spring Data REST with immutable aggregate root types that have a persisted @Version property are affected when they handle HTTP PUT requests. The affected versions listed are 5.1.0; 5.0.0 through 5.0.6; 4.5.0 through 4.5.12; 4.0.0 through 4.4.15; and 3.7.20 and earlier.
What access does an attacker need?
An attacker needs network access and low-level privileges. No user interaction is required.
What is the security impact?
The issue allows mutation of the persisted version property through HTTP PUT, affecting integrity. The provided vector indicates no confidentiality or availability impact.