CVE-2026-47850
Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
CVE-2026-47850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
EUVDEUVD-2026-66820
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
EUVD-2026-66820- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qmj8-w7c8-vhgx
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root...
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
GHSA-qmj8-w7c8-vhgx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
NVD
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
CVE-2026-47850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
OSV
Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
- Record
CVE-2026-47850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1791534183 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.13-tuxcare.10.
- Record
CLSA-2026-1791534183- Updated
- 2026-11-02
Show 14 moreShow less
OSVCLSA-2026-1791988475 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.7.18-tuxcare.9.
- Record
CLSA-2026-1791988475- Updated
- 2026-11-02
OSVCLSA-2026-1791998415 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.4.13-tuxcare.5.
- Record
CLSA-2026-1791998415- Updated
- 2026-11-02
OSVCLSA-2026-1792422770 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.7.16-tuxcare.3.
- Record
CLSA-2026-1792422770- Updated
- 2026-11-02
OSVCLSA-2026-1792429350 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.12-tuxcare.3.
- Record
CLSA-2026-1792429350- Updated
- 2026-11-02
OSVCLSA-2026-1792491807 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.9-tuxcare.3.
- Record
CLSA-2026-1792491807- Updated
- 2026-11-02
OSVCLSA-2026-1792590681 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.6.10-tuxcare.3.
- Record
CLSA-2026-1792590681- Updated
- 2026-11-02
OSVCLSA-2026-1792661853 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.2.
- Record
CLSA-2026-1792661853- Updated
- 2026-11-02
OSVCLSA-2026-1792663094 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.1.8-tuxcare.2.
- Record
CLSA-2026-1792663094- Updated
- 2026-11-02
OSVCLSA-2026-1792669133 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.0.12-tuxcare.2.
- Record
CLSA-2026-1792669133- Updated
- 2026-11-02
OSVCLSA-2026-1793191945 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.2.12-tuxcare.5.
- Record
CLSA-2026-1793191945- Updated
- 2026-11-02
OSVCLSA-2026-1793204572 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (5 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 5 CVEs. Fixed in 3.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793204572- Updated
- 2026-11-02
OSVCLSA-2026-1793352439 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.5.13-tuxcare.6.
- Record
CLSA-2026-1793352439- Updated
- 2026-11-02
OSVCLSA-2026-1793972800 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 2.6.23.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793972800- Updated
- 2026-11-06
OSVCLSA-2026-1793973459 No score
TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.1.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793973459- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
4.3.13 up to 4.3.13-tuxcare.10, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.34.3.13-tuxcare.44.3.13-tuxcare.5 Show 4 moreShow less4.3.13-tuxcare.64.3.13-tuxcare.74.3.13-tuxcare.84.3.13-tuxcare.9 |
4.3.13-tuxcare.10 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.7.18 up to 3.7.18-tuxcare.9, plus listed versions 3.7.18-tuxcare.13.7.18-tuxcare.23.7.18-tuxcare.33.7.18-tuxcare.43.7.18-tuxcare.5 Show 4 moreShow less3.7.18-tuxcare.63.7.18-tuxcare.73.7.18-tuxcare.83.7.18.tuxcare |
3.7.18-tuxcare.9 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs |
4.4.13 up to 4.4.13-tuxcare.5, plus listed versions 4.4.13-tuxcare.14.4.13-tuxcare.24.4.13-tuxcare.34.4.13-tuxcare.4 |
4.4.13-tuxcare.5 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
3.7.16 up to 3.7.16-tuxcare.3, plus listed versions 3.7.16-tuxcare.13.7.16-tuxcare.2 |
3.7.16-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
4.3.12 up to 4.3.12-tuxcare.3, plus listed versions 4.3.12-tuxcare.14.3.12-tuxcare.2 |
4.3.12-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 3 CVEs |
3.4.9 up to 3.4.9-tuxcare.3, plus listed versions 3.4.9-tuxcare.13.4.9-tuxcare.2 |
3.4.9-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
3.6.10 up to 3.6.10-tuxcare.3, plus listed versions 3.6.10-tuxcare.13.6.10-tuxcare.2 |
3.6.10-tuxcare.3 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.5.12 up to 3.5.12-tuxcare.2, plus listed versions 3.5.12-tuxcare.1 |
3.5.12-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
4.1.8 up to 4.1.8-tuxcare.2, plus listed versions 4.1.8-tuxcare.1 |
4.1.8-tuxcare.2 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven |
4.0.12 up to 4.0.12-tuxcare.2, plus listed versions 4.0.12-tuxcare.1 |
4.0.12-tuxcare.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.2.12 up to 4.2.12-tuxcare.5, plus listed versions 4.2.12-tuxcare.14.2.12-tuxcare.24.2.12-tuxcare.34.2.12-tuxcare.4 |
4.2.12-tuxcare.5 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.3.5.RELEASE up to 3.3.5.RELEASE-tuxcare.1 | 3.3.5.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.5.13 up to 4.5.13-tuxcare.6, plus listed versions 4.5.13-tuxcare.14.5.13-tuxcare.24.5.13-tuxcare.34.5.13-tuxcare.44.5.13-tuxcare.5 |
4.5.13-tuxcare.6 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.6.23.RELEASE up to 2.6.23.RELEASE-tuxcare.1 | 2.6.23.RELEASE-tuxcare.1 |
org.springframework.data:spring-data-rest-coreTuxCare:Maven From an advisory covering 4 CVEs |
3.1.5.RELEASE up to 3.1.5.RELEASE-tuxcare.1 | 3.1.5.RELEASE-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| affected, aliases, published | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47850 is a medium vulnerability (CVSS 4.3) in Spring Data Rest, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in org.springframework.data:spring-data-rest-core 4.3.13-tuxcare.10.