Skip to content
fr Sign in
5.3 Medium

CVE-2026-41730 Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing…

Description

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

Affected products and versions

Product Affected versions Fixed in
Spring Data REST 5.0 5.0.0 → < 5.0.5.1 5.0.5.1
Spring Data REST 4.5 4.5.0 → < 4.5.11.1 4.5.11.1
Spring Data REST 4.4 4.4.0 → < 4.4.15 4.4.15
Spring Data REST 4.3 4.3.0 → < 4.3.17 4.3.17
Spring Data REST 3.7 3.7.0 → < 3.7.20 3.7.20

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Data REST

The 6 CVEs of Spring Data REST →
CVE-2026-47849 Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON… 7.1 High CVE-2026-47850 Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an… 4.3 Medium CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and… 5.3 Medium CVE-2026-41729 Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch… 8.1 High
Track this CVE