Spring Data Rest
Approved changes feed: RSS · Atom
cpe:2.3:a:spring:spring_data_rest:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc) |
|---|---|
| Product | Spring Data Rest (0a9987aa-9eba-5b6d-b8ce-9217205c3749) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41837 |
vulnerable | 2026-07-29 00:49:31.485973 |
Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
MEDIUM (5.3)
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.
Affected versions:
Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Published: 2026-06-09T23:49:49.848Z
Updated: 2026-06-30T21:47:41.946Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41730 |
vulnerable | 2026-07-29 00:49:31.482571 |
Spring Data REST exposes persistence-layer internals in error responses
MEDIUM (5.3)
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions:
Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Published: 2026-06-09T23:49:21.572Z
Updated: 2026-06-30T21:47:00.115Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41729 |
vulnerable | 2026-07-29 00:49:31.482307 |
Spring Data REST SpEL Injection via Map Key in JSON Patch
HIGH (8.1)
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions:
Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Published: 2026-06-09T23:49:17.014Z
Updated: 2026-06-11T03:55:37.180Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41728 |
vulnerable | 2026-07-29 00:49:31.482086 |
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
HIGH (7.5)
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions:
Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Published: 2026-06-09T23:49:13.279Z
Updated: 2026-06-30T21:44:46.345Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.