CVE-2026-41729
Spring Data REST SpEL Injection via Map Key in JSON Patch
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Data REST SpEL Injection via Map Key in JSON Patch
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41729- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-917
- Updated
- 2026-11-02
EUVDEUVD-2026-35906
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
EUVD-2026-35906- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j388-8rm5-p97f
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
GHSA-j388-8rm5-p97f- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-917
- Updated
- 2026-11-02
NVD
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41729- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-917
- Updated
- 2026-11-02
OSV
Spring Data REST SpEL Injection via Map Key in JSON Patch
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41729- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-917
- Updated
- 2026-11-02
OSVGHSA-j388-8rm5-p97f
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
GHSA-j388-8rm5-p97f- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-917
- Updated
- 2026-11-02
Show 20 moreShow less
OSVCLSA-2026-1781657701No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.7.18-tuxcare.2.
- Record
CLSA-2026-1781657701- Updated
- 2026-11-02
OSVCLSA-2026-1787144764No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.4.13-tuxcare.1.
- Record
CLSA-2026-1787144764- Updated
- 2026-11-02
OSVCLSA-2026-1787145403No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.4.13-tuxcare.1.
- Record
CLSA-2026-1787145403- Updated
- 2026-11-02
OSVCLSA-2026-1787151813No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.4.13-tuxcare.1.
- Record
CLSA-2026-1787151813- Updated
- 2026-11-02
OSVCLSA-2026-1787405772No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1787405772- Updated
- 2026-11-02
OSVCLSA-2026-1788200439No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1788200439- Updated
- 2026-11-02
OSVCLSA-2026-1788422167No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1788422167- Updated
- 2026-11-02
OSVCLSA-2026-1789669098No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.7.16-tuxcare.1.
- Record
CLSA-2026-1789669098- Updated
- 2026-11-02
OSVCLSA-2026-1789728529No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.6.10-tuxcare.1.
- Record
CLSA-2026-1789728529- Updated
- 2026-11-02
OSVCLSA-2026-1790002044No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.1.8-tuxcare.1.
- Record
CLSA-2026-1790002044- Updated
- 2026-11-02
OSVCLSA-2026-1790062770No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.2.12-tuxcare.4.
- Record
CLSA-2026-1790062770- Updated
- 2026-11-02
OSVCLSA-2026-1790246588No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.12-tuxcare.2.
- Record
CLSA-2026-1790246588- Updated
- 2026-11-02
OSVCLSA-2026-1790612973No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.8-tuxcare.1.
- Record
CLSA-2026-1790612973- Updated
- 2026-11-02
OSVCLSA-2026-1790685464No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.5.12-tuxcare.1.
- Record
CLSA-2026-1790685464- Updated
- 2026-11-02
OSVCLSA-2026-1790691659No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.0.12-tuxcare.1.
- Record
CLSA-2026-1790691659- Updated
- 2026-11-02
OSVCLSA-2026-1791296249No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.1.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791296249- Updated
- 2026-11-02
OSVCLSA-2026-1792491807No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.9-tuxcare.3.
- Record
CLSA-2026-1792491807- Updated
- 2026-11-02
OSVCLSA-2026-1793204572No score
TuxCare security update for org.springframework.data:spring-data-rest-core (5 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 5 CVEs. Fixed in 3.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793204572- Updated
- 2026-11-02
OSVCLSA-2026-1794219621No score
TuxCare security update for org.springframework.data:spring-data-rest-core (6 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 6 CVEs. Fixed in 3.1.21.RELEASE-tuxcare.1.
- Record
CLSA-2026-1794219621- Updated
- 2026-11-09
OSVROOT-APP-MAVEN-CVE-2026-41729No score
CVE-2026-41729 in org.springframework.data:spring-data-rest-core - Patched by Root
Root has patched CVE-2026-41729 in the org.springframework.data:spring-data-rest-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41729- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreMaven | 5.0.0 to 5.0.5 | 5.0.6 |
org.springframework.data:spring-data-rest-coreMaven | 4.5.0 to 4.5.11 | 4.5.12 |
org.springframework.data:spring-data-rest-coreMaven | 4.4.0 to 4.4.14 | None known |
org.springframework.data:spring-data-rest-coreMaven | 4.3.0 to 4.3.16 | None known |
org.springframework.data:spring-data-rest-coreMaven | through 3.7.19 | None known |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 3.7.18 up to 3.7.18-tuxcare.2, plus listed versions 3.7.18-tuxcare.13.7.18.tuxcare | 3.7.18-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 4.4.13 up to 4.4.13-tuxcare.1 | 4.4.13-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 4.3.13 up to 4.3.13-tuxcare.4, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.3 | 4.3.13-tuxcare.4 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 3.7.16 up to 3.7.16-tuxcare.1 | 3.7.16-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 3.6.10 up to 3.6.10-tuxcare.1 | 3.6.10-tuxcare.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 4.1.8 up to 4.1.8-tuxcare.1 | 4.1.8-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 4.2.12 up to 4.2.12-tuxcare.4, plus listed versions 4.2.12-tuxcare.14.2.12-tuxcare.24.2.12-tuxcare.3 | 4.2.12-tuxcare.4 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 4.3.12 up to 4.3.12-tuxcare.2, plus listed versions 4.3.12-tuxcare.1 | 4.3.12-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.4.8 up to 3.4.8-tuxcare.1 | 3.4.8-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.5.12 up to 3.5.12-tuxcare.1 | 3.5.12-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 4.0.12 up to 4.0.12-tuxcare.1 | 4.0.12-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.1.10.RELEASE up to 3.1.10.RELEASE-tuxcare.1 | 3.1.10.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.4.9 up to 3.4.9-tuxcare.3, plus listed versions 3.4.9-tuxcare.13.4.9-tuxcare.2 | 3.4.9-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.3.5.RELEASE up to 3.3.5.RELEASE-tuxcare.1 | 3.3.5.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 6 CVEs | 3.1.21.RELEASE up to 3.1.21.RELEASE-tuxcare.1 | 3.1.21.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreMaven | 5.0.0 up to 5.0.6, plus listed versions 5.0.15.0.25.0.35.0.45.0.5 | 5.0.6 |
org.springframework.data:spring-data-rest-coreMaven | 4.5.0 up to 4.5.12, plus listed versions 4.5.14.5.104.5.114.5.24.5.3 Show 6 moreShow less4.5.44.5.54.5.64.5.74.5.84.5.9 | 4.5.12 |
org.springframework.data:spring-data-rest-coreMaven | 4.4.0 to 4.4.14, plus listed versions 4.4.14.4.104.4.114.4.124.4.13 Show 8 moreShow less4.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9 | None known |
org.springframework.data:spring-data-rest-coreMaven | 4.3.0 to 4.3.16, plus listed versions 4.3.14.3.104.3.114.3.124.3.13 Show 8 moreShow less4.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.9 | None known |
org.springframework.data:spring-data-rest-coreMaven | through 3.7.19, plus listed versions 1.0.0.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE Show 45 moreShow less2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.3.0.RELEASE2.3.1.RELEASE2.3.2.RELEASE2.4.0.RELEASE2.4.1.RELEASE2.4.2.RELEASE2.4.4.RELEASE2.4.5.RELEASE2.4.6.RELEASE2.5.0.RELEASE2.5.1.RELEASE2.5.10.RELEASE2.5.11.RELEASE2.5.2.RELEASE2.5.3.RELEASE2.5.4.RELEASE2.5.5.RELEASE2.5.6.RELEASE2.5.7.RELEASE2.5.8.RELEASE2.5.9.RELEASE2.6.0.RELEASE2.6.1.RELEASE2.6.10.RELEASE2.6.11.RELEASE2.6.12.RELEASE2.6.13.RELEASE2.6.14.RELEASE2.6.15.RELEASE2.6.16.RELEASE2.6.17.RELEASE2.6.18.RELEASE2.6.2.RELEASE2.6.20.RELEASE | None known |
org.springframework.data:spring-data-rest-coreRoot:Maven | before 4.5.10-aikido.1 | 4.5.10-aikido.15.0.4-aikido.14.3.5-aikido.1 |
io.root.org.springframework.data:spring-data-rest-coreRoot:Maven | before 4.5.10-root.io.1 | 4.5.10-root.io.15.0.4-root.io.14.3.5-root.io.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | daehyuh/CVE-2026-41729 | 2026-05-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41729 is a high vulnerability (CVSS 8.1) in Spring Data Rest, published June 9, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in org.springframework.data:spring-data-rest-core 5.0.6.
References
spring.io/security/cve-2026-41729
nvd.nist.gov/vuln/detail/CVE-2026-41729
github.com/spring-projects/spring-data-rest/releases/tag/4.5.12
Left out here: 130 versions. The JSON record has them.