Recently modified vulnerabilities for "vmware spring data rest" 4.5.0

Where

AND

Sort:

Spring Spring Data RESTSpring Data REST allows mutation of the version property of immutable aggregates via PUT

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

First published (updated )

CVE-2026-47850

Spring Spring Data RESTSpring Data REST allows mutation of identifier and version properties via JSON Patch

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

First published (updated )

CVE-2026-47849

maven/org.springframework.data/spring-data-restSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

Risk 43

Severity

7.5

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

First published (updated )

CVE-2026-41728

maven/org.springframework.data/spring-data-rest-webmvcSpring Data REST SpEL Injection via Map Key in JSON Patch

Risk 60

Severity

8.1

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

First published (updated )

CVE-2026-41729

Spring Spring Data RESTSpring Data REST exposes persistence-layer internals in error responses

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

First published (updated )

CVE-2026-41730

Spring Spring Data RESTSpring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

First published (updated )

CVE-2026-41837

Trending

Spring Spring Data RESTSpring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Spring Data RESTSpring Data REST allows mutation of identifier and version properties via JSON Patch

maven/org.springframework.data/spring-data-restSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

maven/org.springframework.data/spring-data-rest-webmvcSpring Data REST SpEL Injection via Map Key in JSON Patch

Spring Spring Data RESTSpring Data REST exposes persistence-layer internals in error responses

Spring Spring Data RESTSpring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Company

Resources

Contact