CVE-2026-41729
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Spring Data REST involving SpEL expression injection through map-typed properties when processing JSON Patch requests. The JSON Pointer path segment used as the map key is embedded into a SpEL expression without sanitization. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.
Risk Assessment
Risk of remote code execution (RCE) by an attacker sending a crafted JSON Patch request, potentially leading to full server compromise.
Recommendation
Upgrade Spring Data REST to version 3.7.20, 4.3.17, 4.4.15, 4.5.12, or 5.0.6 (depending on your line). Restrict access to JSON Patch endpoints.
Other vulnerabilities in Spring Data REST
See all- CVE-2026-47849High
Spring Data REST versions 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier do not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch requests.
- CVE-2026-47850Medium
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Affects Spring Data REST 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier.
- CVE-2026-41837Medium
Spring Data REST's Querydsl integration accepts arbitrary property paths as filter keys and ignores Jackson customizations before handing them to Querydsl. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.
- CVE-2026-41730Medium
Vulnerability in Spring Data REST where the full exception cause chain is serialized into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.
- CVE-2026-41728High
Spring Data REST's JSON Patch implementation does not apply write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5.
Original NVD description (English source)
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.