CVE-2026-41730
Spring Data REST exposes persistence-layer internals in error responses
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Data REST exposes persistence-layer internals in error responses
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41730- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2026-35907
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
EUVD-2026-35907- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p5mm-xwgq-whfr
Spring Data REST potentially exposes persistence-layer internals to HTTP clients
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
GHSA-p5mm-xwgq-whfr- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41730- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Spring Data REST exposes persistence-layer internals in error responses
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41730- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-p5mm-xwgq-whfr
Spring Data REST potentially exposes persistence-layer internals to HTTP clients
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
GHSA-p5mm-xwgq-whfr- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
Show 19 moreShow less
OSVCLSA-2026-1787405772No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1787405772- Updated
- 2026-11-02
OSVCLSA-2026-1788200439No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1788200439- Updated
- 2026-11-02
OSVCLSA-2026-1788422167No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1788422167- Updated
- 2026-11-02
OSVCLSA-2026-1789582512No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.3.12-tuxcare.1.
- Record
CLSA-2026-1789582512- Updated
- 2026-11-02
OSVCLSA-2026-1789667196No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.4.9-tuxcare.1.
- Record
CLSA-2026-1789667196- Updated
- 2026-11-02
OSVCLSA-2026-1789669098No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.7.16-tuxcare.1.
- Record
CLSA-2026-1789669098- Updated
- 2026-11-02
OSVCLSA-2026-1789728529No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.6.10-tuxcare.1.
- Record
CLSA-2026-1789728529- Updated
- 2026-11-02
OSVCLSA-2026-1790002044No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.1.8-tuxcare.1.
- Record
CLSA-2026-1790002044- Updated
- 2026-11-02
OSVCLSA-2026-1790062770No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.2.12-tuxcare.4.
- Record
CLSA-2026-1790062770- Updated
- 2026-11-02
OSVCLSA-2026-1790097065No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.7.18-tuxcare.8.
- Record
CLSA-2026-1790097065- Updated
- 2026-11-02
OSVCLSA-2026-1790612973No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.8-tuxcare.1.
- Record
CLSA-2026-1790612973- Updated
- 2026-11-02
OSVCLSA-2026-1790685464No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.5.12-tuxcare.1.
- Record
CLSA-2026-1790685464- Updated
- 2026-11-02
OSVCLSA-2026-1790691659No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.0.12-tuxcare.1.
- Record
CLSA-2026-1790691659- Updated
- 2026-11-02
OSVCLSA-2026-1791296249No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.1.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791296249- Updated
- 2026-11-02
OSVCLSA-2026-1791998415No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.4.13-tuxcare.5.
- Record
CLSA-2026-1791998415- Updated
- 2026-11-02
OSVCLSA-2026-1793204572No score
TuxCare security update for org.springframework.data:spring-data-rest-core (5 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 5 CVEs. Fixed in 3.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793204572- Updated
- 2026-11-02
OSVCLSA-2026-1793972800No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 2.6.23.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793972800- Updated
- 2026-11-06
OSVCLSA-2026-1793973459No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.1.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793973459- Updated
- 2026-11-06
OSVCLSA-2026-1794219621No score
TuxCare security update for org.springframework.data:spring-data-rest-core (6 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 6 CVEs. Fixed in 3.1.21.RELEASE-tuxcare.1.
- Record
CLSA-2026-1794219621- Updated
- 2026-11-09
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreMaven | 5.0.0 to 5.0.5 | 5.0.6 |
org.springframework.data:spring-data-rest-coreMaven | 4.5.0 to 4.5.11 | 4.5.12 |
org.springframework.data:spring-data-rest-coreMaven | 4.4.0 to 4.4.14 | None known |
org.springframework.data:spring-data-rest-coreMaven | 4.3.0 to 4.3.16 | None known |
org.springframework.data:spring-data-rest-coreMaven | through 3.7.19 | None known |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 4.3.13 up to 4.3.13-tuxcare.4, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.3 | 4.3.13-tuxcare.4 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 4.3.12 up to 4.3.12-tuxcare.1 | 4.3.12-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.4.9 up to 3.4.9-tuxcare.1 | 3.4.9-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 3.7.16 up to 3.7.16-tuxcare.1 | 3.7.16-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 3.6.10 up to 3.6.10-tuxcare.1 | 3.6.10-tuxcare.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 4.1.8 up to 4.1.8-tuxcare.1 | 4.1.8-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 4.2.12 up to 4.2.12-tuxcare.4, plus listed versions 4.2.12-tuxcare.14.2.12-tuxcare.24.2.12-tuxcare.3 | 4.2.12-tuxcare.4 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.7.18 up to 3.7.18-tuxcare.8, plus listed versions 3.7.18-tuxcare.13.7.18-tuxcare.23.7.18-tuxcare.33.7.18-tuxcare.43.7.18-tuxcare.53.7.18-tuxcare.63.7.18-tuxcare.73.7.18.tuxcare | 3.7.18-tuxcare.8 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.4.8 up to 3.4.8-tuxcare.1 | 3.4.8-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.5.12 up to 3.5.12-tuxcare.1 | 3.5.12-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 4.0.12 up to 4.0.12-tuxcare.1 | 4.0.12-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.1.10.RELEASE up to 3.1.10.RELEASE-tuxcare.1 | 3.1.10.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 4.4.13 up to 4.4.13-tuxcare.5, plus listed versions 4.4.13-tuxcare.14.4.13-tuxcare.24.4.13-tuxcare.34.4.13-tuxcare.4 | 4.4.13-tuxcare.5 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.3.5.RELEASE up to 3.3.5.RELEASE-tuxcare.1 | 3.3.5.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 2.6.23.RELEASE up to 2.6.23.RELEASE-tuxcare.1 | 2.6.23.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 3.1.5.RELEASE up to 3.1.5.RELEASE-tuxcare.1 | 3.1.5.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 6 CVEs | 3.1.21.RELEASE up to 3.1.21.RELEASE-tuxcare.1 | 3.1.21.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreMaven | 5.0.0 up to 5.0.6, plus listed versions 5.0.15.0.25.0.35.0.45.0.5 | 5.0.6 |
org.springframework.data:spring-data-rest-coreMaven | 4.5.0 up to 4.5.12, plus listed versions 4.5.14.5.104.5.114.5.24.5.3 Show 6 moreShow less4.5.44.5.54.5.64.5.74.5.84.5.9 | 4.5.12 |
org.springframework.data:spring-data-rest-coreMaven | 4.4.0 to 4.4.14, plus listed versions 4.4.14.4.104.4.114.4.124.4.13 Show 8 moreShow less4.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9 | None known |
org.springframework.data:spring-data-rest-coreMaven | 4.3.0 to 4.3.16, plus listed versions 4.3.14.3.104.3.114.3.124.3.13 Show 8 moreShow less4.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.9 | None known |
org.springframework.data:spring-data-rest-coreMaven | through 3.7.19, plus listed versions 1.0.0.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE Show 45 moreShow less2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.3.0.RELEASE2.3.1.RELEASE2.3.2.RELEASE2.4.0.RELEASE2.4.1.RELEASE2.4.2.RELEASE2.4.4.RELEASE2.4.5.RELEASE2.4.6.RELEASE2.5.0.RELEASE2.5.1.RELEASE2.5.10.RELEASE2.5.11.RELEASE2.5.2.RELEASE2.5.3.RELEASE2.5.4.RELEASE2.5.5.RELEASE2.5.6.RELEASE2.5.7.RELEASE2.5.8.RELEASE2.5.9.RELEASE2.6.0.RELEASE2.6.1.RELEASE2.6.10.RELEASE2.6.11.RELEASE2.6.12.RELEASE2.6.13.RELEASE2.6.14.RELEASE2.6.15.RELEASE2.6.16.RELEASE2.6.17.RELEASE2.6.18.RELEASE2.6.2.RELEASE2.6.20.RELEASE | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, facts | ||
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41730 is a medium vulnerability (CVSS 5.3) in Spring Data Rest, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in org.springframework.data:spring-data-rest-core 5.0.6.
References
spring.io/security/cve-2026-41730
nvd.nist.gov/vuln/detail/CVE-2026-41730
github.com/spring-projects/spring-data-rest/releases/tag/4.5.12
Left out here: 130 versions. The JSON record has them.