Skip to content
fr Sign in
4.3 Medium

CVE-2026-47850 Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an…

Description

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

Affected products and versions

Product Affected versions Fixed in
Spring Data REST 5.1.0 No fix stated
Spring Data REST 5.0 5.0.0 → 5.0.6 No fix stated
Spring Data REST 4.5 4.5.0 → 4.5.12 No fix stated
Spring Data REST 4.0 4.0.0 → 4.4.15 No fix stated
Spring Data REST 3.7 earliest → 3.7.20 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Data REST

The 6 CVEs of Spring Data REST →
CVE-2026-47849 Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON… 7.1 High CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and… 5.3 Medium CVE-2026-41730 Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing… 5.3 Medium CVE-2026-41729 Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch… 8.1 High
Track this CVE