7.5
Élevée
CVE-2026-41728 Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to…
Description
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Data REST 5.0 | 5.0.0 → < 5.0.5.1 | 5.0.5.1 |
| Spring Data REST 4.5 | 4.5.0 → < 4.5.11.1 | 4.5.11.1 |
| Spring Data REST 4.4 | 4.4.0 → < 4.4.15 | 4.4.15 |
| Spring Data REST 4.3 | 4.3.0 → < 4.3.17 | 4.3.17 |
| Spring Data REST 3.7 | 3.7.0 → < 3.7.20 | 3.7.20 |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Data REST
Les 6 CVE de Spring Data REST →
CVE-2026-47849
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON…
7.1
Élevée
CVE-2026-47850
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an…
4.3
Moyenne
CVE-2026-41837
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and…
5.3
Moyenne
CVE-2026-41730
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing…
5.3
Moyenne