Spring Data Rest (Vmware) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 274 known versions, newest CVE from 2026-08-27. Vendor: Vmware.
CVEs of Spring Data Rest
- CVE-2026-47849 - CVSS 7.1 (high), 2026-08-27: Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json)…
- CVE-2026-47850 - CVSS 4.3 (medium), 2026-08-26: Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.…
- CVE-2026-41729 - CVSS 8.1 (high), 2026-06-10: Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests.…
- CVE-2026-41728 - CVSS 7.5 (high), 2026-06-10: Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving…
- CVE-2026-41837 - CVSS 5.3 (medium), 2026-06-10: Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson…
- CVE-2026-41730 - CVSS 5.3 (medium), 2026-06-10: Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.…
- CVE-2022-31679 - CVSS 3.7 (low), 2022-09-21: Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions,…
- CVE-2021-22047 - CVSS 5.3 (medium), 2021-10-28: In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a…
- CVE-2018-1259 - CVSS 7.5 (high), 2018-05-11: Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property…
- CVE-2018-1274 - CVSS 7.5 (high), 2018-04-18: Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited…
- CVE-2018-1273 - CVSS 9.8 (critical), 2018-04-11: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by…
- CVE-2017-8046 - CVSS 9.8 (critical), 2018-01-04: Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot…
