CVE-2026-41730
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Vulnerability in Spring Data REST where the full exception cause chain is serialized into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.
Risk Assessment
Attackers can gain access to internal database or application logic details, which may facilitate further attacks such as SQL Injection or other data manipulation.
Recommendation
Update Spring Data REST to a patched version or configure appropriate exception masking in error responses.
Other vulnerabilities in Spring Data REST
See all- CVE-2026-47849High
Spring Data REST versions 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier do not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch requests.
- CVE-2026-47850Medium
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Affects Spring Data REST 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier.
- CVE-2026-41837Medium
Spring Data REST's Querydsl integration accepts arbitrary property paths as filter keys and ignores Jackson customizations before handing them to Querydsl. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.
- CVE-2026-41729High
Vulnerability in Spring Data REST involving SpEL expression injection through map-typed properties when processing JSON Patch requests. The JSON Pointer path segment used as the map key is embedded into a SpEL expression without sanitization. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.
- CVE-2026-41728High
Spring Data REST's JSON Patch implementation does not apply write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5.
Original NVD description (English source)
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.