Skip to content
fr Sign in
8.1 High

CVE-2026-41729 Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch…

Description

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

Affected products and versions

Product Affected versions Fixed in
Spring Data REST 5.0 5.0.0 → < 5.0.6 5.0.6
Spring Data REST 4.5 4.5.0 → < 4.5.12 4.5.12
Spring Data REST 4.4 4.4.0 → < 4.4.15 4.4.15
Spring Data REST 4.3 4.3.0 → < 4.3.17 4.3.17
Spring Data REST 3.7 3.7.0 → < 3.7.20 3.7.20

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Data REST

The 6 CVEs of Spring Data REST →
CVE-2026-47849 Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON… 7.1 High CVE-2026-47850 Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an… 4.3 Medium CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and… 5.3 Medium CVE-2026-41730 Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing… 5.3 Medium
Track this CVE