CVE-2026-41728
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41728- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-35905
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
EUVD-2026-35905- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cv39-x4c6-hhp2
Spring Data REST has Improper Access Control in its JSON Patch Implementation
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
GHSA-cv39-x4c6-hhp2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41728- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
CVE-2026-41728- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-cv39-x4c6-hhp2
Spring Data REST has Improper Access Control in its JSON Patch Implementation
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Record
GHSA-cv39-x4c6-hhp2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
Show 7 moreShow less
OSVCLSA-2026-1787405772 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1787405772- Updated
- 2026-11-02
OSVCLSA-2026-1788200439 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1788200439- Updated
- 2026-11-02
OSVCLSA-2026-1788422167 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4.
- Record
CLSA-2026-1788422167- Updated
- 2026-11-02
OSVCLSA-2026-1790958488 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.7.16-tuxcare.2.
- Record
CLSA-2026-1790958488- Updated
- 2026-11-02
OSVCLSA-2026-1791988475 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.7.18-tuxcare.9.
- Record
CLSA-2026-1791988475- Updated
- 2026-11-02
OSVCLSA-2026-1793191945 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.2.12-tuxcare.5.
- Record
CLSA-2026-1793191945- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-41728 No score
CVE-2026-41728 in org.springframework.data:spring-data-rest-core - Patched by Root
Root has patched CVE-2026-41728 in the org.springframework.data:spring-data-rest-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41728- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreMaven |
5.0.0 to 5.0.5 | 5.0.6 |
org.springframework.data:spring-data-rest-coreMaven |
4.5.0 to 4.5.11 | 4.5.12 |
org.springframework.data:spring-data-rest-coreMaven |
4.4.0 to 4.4.14 | None known |
org.springframework.data:spring-data-rest-coreMaven |
4.3.0 to 4.3.16 | None known |
org.springframework.data:spring-data-rest-coreMaven |
through 3.7.19 | None known |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs |
4.3.13 up to 4.3.13-tuxcare.4, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.3 |
4.3.13-tuxcare.4 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
3.7.16 up to 3.7.16-tuxcare.2, plus listed versions 3.7.16-tuxcare.1 |
3.7.16-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.7.18 up to 3.7.18-tuxcare.9, plus listed versions 3.7.18-tuxcare.13.7.18-tuxcare.23.7.18-tuxcare.33.7.18-tuxcare.43.7.18-tuxcare.5 Show 4 moreShow less3.7.18-tuxcare.63.7.18-tuxcare.73.7.18-tuxcare.83.7.18.tuxcare |
3.7.18-tuxcare.9 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.2.12 up to 4.2.12-tuxcare.5, plus listed versions 4.2.12-tuxcare.14.2.12-tuxcare.24.2.12-tuxcare.34.2.12-tuxcare.4 |
4.2.12-tuxcare.5 |
org.springframework.data:spring-data-rest-coreMaven |
5.0.0 up to 5.0.6, plus listed versions 5.0.15.0.25.0.35.0.45.0.5 |
5.0.6 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreMaven |
4.5.0 up to 4.5.12, plus listed versions 4.5.14.5.104.5.114.5.24.5.3 Show 6 moreShow less4.5.44.5.54.5.64.5.74.5.84.5.9 |
4.5.12 |
org.springframework.data:spring-data-rest-coreMaven |
4.4.0 to 4.4.14, plus listed versions 4.4.14.4.104.4.114.4.124.4.13 Show 8 moreShow less4.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9 |
None known |
org.springframework.data:spring-data-rest-coreMaven |
4.3.0 to 4.3.16, plus listed versions 4.3.14.3.104.3.114.3.124.3.13 Show 8 moreShow less4.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.9 |
None known |
org.springframework.data:spring-data-rest-coreMaven |
through 3.7.19, plus listed versions 1.0.0.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE Show 45 moreShow less2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.3.0.RELEASE2.3.1.RELEASE2.3.2.RELEASE2.4.0.RELEASE2.4.1.RELEASE2.4.2.RELEASE2.4.4.RELEASE2.4.5.RELEASE2.4.6.RELEASE2.5.0.RELEASE2.5.1.RELEASE2.5.10.RELEASE2.5.11.RELEASE2.5.2.RELEASE2.5.3.RELEASE2.5.4.RELEASE2.5.5.RELEASE2.5.6.RELEASE2.5.7.RELEASE2.5.8.RELEASE2.5.9.RELEASE2.6.0.RELEASE2.6.1.RELEASE2.6.10.RELEASE2.6.11.RELEASE2.6.12.RELEASE2.6.13.RELEASE2.6.14.RELEASE2.6.15.RELEASE2.6.16.RELEASE2.6.17.RELEASE2.6.18.RELEASE2.6.2.RELEASE2.6.20.RELEASE |
None known |
org.springframework.data:spring-data-rest-coreRoot:Maven |
before 4.5.10-aikido.1 | 4.5.10-aikido.15.0.4-aikido.14.3.5-aikido.1 |
io.root.org.springframework.data:spring-data-rest-coreRoot:Maven |
before 4.5.10-root.io.1 | 4.5.10-root.io.15.0.4-root.io.14.3.5-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41728 is a high vulnerability (CVSS 7.5) in Spring Data Rest, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in org.springframework.data:spring-data-rest-core 5.0.6.
References
spring.io/security/cve-2026-41728
nvd.nist.gov/vuln/detail/CVE-2026-41728
github.com/spring-projects/spring-data-rest/releases/tag/4.5.12
Left out here: 130 versions. The JSON record has them.