- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 7 · 2 high, 2 medium, 1 low
- Dependents
- 5
- Registry
- Maven Central
Advisories 7
- CVE-2026-41837Medium 5.3
Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
Affected: from 5.0.0, fixed in 5.0.6; from 4.5.0, fixed in 4.5.12; from 4.4.0, through 4.4.14; from 4.3.0, through 4.3.16; through 3.7.19.
- CVE-2026-41730Medium 5.3
Spring Data REST exposes persistence-layer internals in error responses
Affected: from 5.0.0, fixed in 5.0.6; from 4.5.0, fixed in 4.5.12; from 4.4.0, through 4.4.14; from 4.3.0, through 4.3.16; through 3.7.19.
- CVE-2026-41729High 8.1
Spring Data REST SpEL Injection via Map Key in JSON Patch
Affected: from 5.0.0, fixed in 5.0.6; from 4.5.0, fixed in 4.5.12; from 4.4.0, through 4.4.14; from 4.3.0, through 4.3.16; through 3.7.19.
- CVE-2026-41728High 7.5
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Affected: from 5.0.0, fixed in 5.0.6; from 4.5.0, fixed in 4.5.12; from 4.4.0, through 4.4.14; from 4.3.0, through 4.3.16; through 3.7.19.
- CVE-2022-31679Low 3.7
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older…
Affected: from 3.6.0, fixed in 3.6.7; from 3.7.0, fixed in 3.7.3.
- CVE-2021-22047Unrated
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom…
Affected: from 3.4.0, fixed in 3.4.14; from 3.5.0, fixed in 3.5.6.
- CVE-2017-8046Unrated
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay…
Affected: fixed in 2.6.9.RELEASE; from 3.0.0, fixed in 3.0.1.RELEASE.