What’s Vulnerable › Products

Spring Data REST vulnerabilities

12 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Spring Data REST version is affected

Exploited Spring Data REST vulnerabilities

• CVE-2018-1273 — VMware Tanzu Spring Data Commons Property Binder Vulnerability

Latest Spring Data REST vulnerabilities

• CVE-2026-47849 — Spring Data REST allows mutation of identifier and version properties via JSON Patch (CVSS 7.1)
• CVE-2026-47850 — Spring Data REST allows mutation of the version property of immutable aggregates via PUT (CVSS 4.3)
• CVE-2026-41837 — Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys (CVSS 5.3)
• CVE-2026-41730 — Spring Data REST exposes persistence-layer internals in error responses (CVSS 5.3)
• CVE-2026-41729 — Spring Data REST SpEL Injection via Map Key in JSON Patch (CVSS 8.1)
• CVE-2026-41728 — Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections (CVSS 7.5)
• CVE-2022-31679 — (CVSS 3.7)
• CVE-2021-22047 — (CVSS 5.3)
• CVE-2018-1259 — (CVSS 7.5)
• CVE-2018-1274 — (CVSS 7.5)
• CVE-2018-1273 — VMware Tanzu Spring Data Commons Property Binder Vulnerability (CVSS 9.8) — exploited
• CVE-2017-8046 — (CVSS 9.8)