CVE-2026-47850
Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
CVE-2026-47850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
EUVDEUVD-2026-66820
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
EUVD-2026-66820- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qmj8-w7c8-vhgx
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root...
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
GHSA-qmj8-w7c8-vhgx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
NVD
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
CVE-2026-47850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
OSV
Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
CVE-2026-47850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1791534183No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.13-tuxcare.10.
- Record
CLSA-2026-1791534183- Updated
- 2026-11-02
Show 16 moreShow less
OSVCLSA-2026-1791988475No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.7.18-tuxcare.9.
- Record
CLSA-2026-1791988475- Updated
- 2026-11-02
OSVCLSA-2026-1791998415No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.4.13-tuxcare.5.
- Record
CLSA-2026-1791998415- Updated
- 2026-11-02
OSVCLSA-2026-1792422770No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.7.16-tuxcare.3.
- Record
CLSA-2026-1792422770- Updated
- 2026-11-02
OSVCLSA-2026-1792429350No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.12-tuxcare.3.
- Record
CLSA-2026-1792429350- Updated
- 2026-11-02
OSVCLSA-2026-1792491807No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.9-tuxcare.3.
- Record
CLSA-2026-1792491807- Updated
- 2026-11-02
OSVCLSA-2026-1792590681No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.6.10-tuxcare.3.
- Record
CLSA-2026-1792590681- Updated
- 2026-11-02
OSVCLSA-2026-1792661853No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.2.
- Record
CLSA-2026-1792661853- Updated
- 2026-11-02
OSVCLSA-2026-1792663094No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.1.8-tuxcare.2.
- Record
CLSA-2026-1792663094- Updated
- 2026-11-02
OSVCLSA-2026-1792669133No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.0.12-tuxcare.2.
- Record
CLSA-2026-1792669133- Updated
- 2026-11-02
OSVCLSA-2026-1793191945No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.2.12-tuxcare.5.
- Record
CLSA-2026-1793191945- Updated
- 2026-11-02
OSVCLSA-2026-1793204572No score
TuxCare security update for org.springframework.data:spring-data-rest-core (5 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 5 CVEs. Fixed in 3.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793204572- Updated
- 2026-11-02
OSVCLSA-2026-1793352439No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.5.13-tuxcare.6.
- Record
CLSA-2026-1793352439- Updated
- 2026-11-02
OSVCLSA-2026-1793972800No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 2.6.23.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793972800- Updated
- 2026-11-06
OSVCLSA-2026-1793973459No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.1.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793973459- Updated
- 2026-11-06
OSVCLSA-2026-1794219621No score
TuxCare security update for org.springframework.data:spring-data-rest-core (6 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 6 CVEs. Fixed in 3.1.21.RELEASE-tuxcare.1.
- Record
CLSA-2026-1794219621- Updated
- 2026-11-09
OSVCLSA-2026-1794402771No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.1.10.RELEASE-tuxcare.2.
- Record
CLSA-2026-1794402771- Updated
- 2026-11-11
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 4.3.13 up to 4.3.13-tuxcare.10, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.34.3.13-tuxcare.44.3.13-tuxcare.5 Show 4 moreShow less4.3.13-tuxcare.64.3.13-tuxcare.74.3.13-tuxcare.84.3.13-tuxcare.9 | 4.3.13-tuxcare.10 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.7.18 up to 3.7.18-tuxcare.9, plus listed versions 3.7.18-tuxcare.13.7.18-tuxcare.23.7.18-tuxcare.33.7.18-tuxcare.43.7.18-tuxcare.5 Show 4 moreShow less3.7.18-tuxcare.63.7.18-tuxcare.73.7.18-tuxcare.83.7.18.tuxcare | 3.7.18-tuxcare.9 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 4.4.13 up to 4.4.13-tuxcare.5, plus listed versions 4.4.13-tuxcare.14.4.13-tuxcare.24.4.13-tuxcare.34.4.13-tuxcare.4 | 4.4.13-tuxcare.5 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 3.7.16 up to 3.7.16-tuxcare.3, plus listed versions 3.7.16-tuxcare.13.7.16-tuxcare.2 | 3.7.16-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 4.3.12 up to 4.3.12-tuxcare.3, plus listed versions 4.3.12-tuxcare.14.3.12-tuxcare.2 | 4.3.12-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.4.9 up to 3.4.9-tuxcare.3, plus listed versions 3.4.9-tuxcare.13.4.9-tuxcare.2 | 3.4.9-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 3.6.10 up to 3.6.10-tuxcare.3, plus listed versions 3.6.10-tuxcare.13.6.10-tuxcare.2 | 3.6.10-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.5.12 up to 3.5.12-tuxcare.2, plus listed versions 3.5.12-tuxcare.1 | 3.5.12-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 4.1.8 up to 4.1.8-tuxcare.2, plus listed versions 4.1.8-tuxcare.1 | 4.1.8-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven | 4.0.12 up to 4.0.12-tuxcare.2, plus listed versions 4.0.12-tuxcare.1 | 4.0.12-tuxcare.2 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.2.12 up to 4.2.12-tuxcare.5, plus listed versions 4.2.12-tuxcare.14.2.12-tuxcare.24.2.12-tuxcare.34.2.12-tuxcare.4 | 4.2.12-tuxcare.5 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 5 CVEs | 3.3.5.RELEASE up to 3.3.5.RELEASE-tuxcare.1 | 3.3.5.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.5.13 up to 4.5.13-tuxcare.6, plus listed versions 4.5.13-tuxcare.14.5.13-tuxcare.24.5.13-tuxcare.34.5.13-tuxcare.44.5.13-tuxcare.5 | 4.5.13-tuxcare.6 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 2.6.23.RELEASE up to 2.6.23.RELEASE-tuxcare.1 | 2.6.23.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs | 3.1.5.RELEASE up to 3.1.5.RELEASE-tuxcare.1 | 3.1.5.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 6 CVEs | 3.1.21.RELEASE up to 3.1.21.RELEASE-tuxcare.1 | 3.1.21.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs | 3.1.10.RELEASE up to 3.1.10.RELEASE-tuxcare.2, plus listed versions 3.1.10.RELEASE-tuxcare.1 | 3.1.10.RELEASE-tuxcare.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, facts | ||
| affected, aliases, published | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47850 is a medium vulnerability (CVSS 4.3) in Spring Data Rest, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in org.springframework.data:spring-data-rest-core 4.3.13-tuxcare.10.