{"id":"CVE-2026-47849","aliases":["CLSA-2026-1788196746","CLSA-2026-1788279532","CLSA-2026-1788279697","CLSA-2026-1788357718","CLSA-2026-1788359035","CLSA-2026-1788422135","CLSA-2026-1789582512","CLSA-2026-1789669098","CLSA-2026-1789728529","CLSA-2026-1790002044","CLSA-2026-1790691659","CLSA-2026-1792491807","CLSA-2026-1792661853","CLSA-2026-1793204572","CLSA-2026-1793352439","CLSA-2026-1793972800","CLSA-2026-1793973459","CLSA-2026-1794219621","EUVD-2026-66837","GHSA-4xj4-jmcc-9rq7"],"status":"published","title":"Spring Data REST allows mutation of identifier and version properties via JSON Patch","description":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00351,"percentile":0.28997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-915"],"published":"2026-08-27T05:06:23Z","modified":"2026-11-09T19:15:04Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","fixed_in":["4.3.13-tuxcare.5","4.2.12-tuxcare.3","4.4.13-tuxcare.3","3.7.18-tuxcare.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.13"},{"fixed":"4.3.13-tuxcare.5"}]}],"versions":["4.3.13","4.3.13-tuxcare.1","4.3.13-tuxcare.2","4.3.13-tuxcare.3","4.3.13-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12"},{"fixed":"4.2.12-tuxcare.3"}]}],"versions":["4.2.12","4.2.12-tuxcare.1","4.2.12-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.13"},{"fixed":"4.4.13-tuxcare.3"}]}],"versions":["4.4.13","4.4.13-tuxcare.1","4.4.13-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.18"},{"fixed":"3.7.18-tuxcare.7"}]}],"versions":["3.7.18","3.7.18-tuxcare.1","3.7.18-tuxcare.2","3.7.18-tuxcare.3","3.7.18-tuxcare.4","3.7.18-tuxcare.5","3.7.18-tuxcare.6","3.7.18.tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.12"},{"fixed":"4.3.12-tuxcare.1"}]}],"versions":["4.3.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.16"},{"fixed":"3.7.16-tuxcare.1"}]}],"versions":["3.7.16"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.10"},{"fixed":"3.6.10-tuxcare.1"}]}],"versions":["3.6.10"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.8"},{"fixed":"4.1.8-tuxcare.1"}]}],"versions":["4.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.12"},{"fixed":"4.0.12-tuxcare.1"}]}],"versions":["4.0.12"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.9"},{"fixed":"3.4.9-tuxcare.3"}]}],"versions":["3.4.9","3.4.9-tuxcare.1","3.4.9-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.12"},{"fixed":"3.5.12-tuxcare.2"}]}],"versions":["3.5.12","3.5.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.5.RELEASE"},{"fixed":"3.3.5.RELEASE-tuxcare.1"}]}],"versions":["3.3.5.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.13"},{"fixed":"4.5.13-tuxcare.6"}]}],"versions":["4.5.13","4.5.13-tuxcare.1","4.5.13-tuxcare.2","4.5.13-tuxcare.3","4.5.13-tuxcare.4","4.5.13-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.23.RELEASE"},{"fixed":"2.6.23.RELEASE-tuxcare.1"}]}],"versions":["2.6.23.RELEASE"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5.RELEASE"},{"fixed":"3.1.5.RELEASE-tuxcare.1"}]}],"versions":["3.1.5.RELEASE"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.21.RELEASE"},{"fixed":"3.1.21.RELEASE-tuxcare.1"}]}],"versions":["3.1.21.RELEASE"],"bundled":6}],"products":[{"vendor":"spring","product":"spring data rest"},{"vendor":"vmware","product":"spring_data_rest"}],"references":[{"url":"https://spring.io/security/cve-2026-47849","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47849","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4xj4-jmcc-9rq7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47849.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47849","title":"Spring Data REST allows mutation of identifier and version properties via JSON Patch","description":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T05:06:23.97Z","modified":"2026-08-27T13:04:25.615Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66837","description":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T05:06:23Z","modified":"2026-08-27T13:04:25Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:28.581047Z"}],"ghsa":[{"id":"GHSA-4xj4-jmcc-9rq7","title":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against...","description":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T06:31:34Z","modified":"2026-08-27T18:32:09Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47849","description":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T06:17:16.653Z","modified":"2026-09-02T15:47:11.09Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-47849","title":"Spring Data REST allows mutation of identifier and version properties via JSON Patch","description":"Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T05:06:23.97Z","modified":"2026-10-28T02:30:54.882157937Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1788196746","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.13-tuxcare.5.","status":"published","published":"2026-08-31T17:19:06Z","modified":"2026-11-02T19:46:01.876302956Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788279532","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.2.12-tuxcare.3.","status":"published","published":"2026-09-01T16:18:52Z","modified":"2026-11-02T19:46:03.100422812Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788279697","title":"TuxCare security update for org.springframework.data (1 CVE)","description":"TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.2.12-tuxcare.3.","status":"withdrawn","published":"2026-09-01T16:21:37Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788357718","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.4.13-tuxcare.3.","status":"published","published":"2026-09-02T14:01:58Z","modified":"2026-11-02T19:46:02.985663376Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788359035","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.7.18-tuxcare.7.","status":"published","published":"2026-09-02T14:23:55Z","modified":"2026-11-02T19:46:02.848148688Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788422135","title":"TuxCare security update for org.springframework.data (2 CVEs)","description":"TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 4.3.13-tuxcare.5.","status":"withdrawn","published":"2026-09-03T07:55:35Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789582512","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.3.12-tuxcare.1.","status":"published","published":"2026-09-16T18:15:12Z","modified":"2026-11-02T19:46:18.225623546Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1789669098","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.7.16-tuxcare.1.","status":"published","published":"2026-09-17T18:18:18Z","modified":"2026-11-02T19:46:17.774981429Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789728529","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.6.10-tuxcare.1.","status":"published","published":"2026-09-18T10:48:49Z","modified":"2026-11-02T19:46:19.405648125Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1790002044","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.1.8-tuxcare.1.","status":"published","published":"2026-09-21T14:47:24Z","modified":"2026-11-02T19:46:18.915077402Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1790691659","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 4.0.12-tuxcare.1.","status":"published","published":"2026-09-29T14:20:59Z","modified":"2026-11-02T19:46:24.42466621Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1792491807","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.9-tuxcare.3.","status":"published","published":"2026-10-20T10:23:27Z","modified":"2026-11-02T19:46:30.17204033Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792661853","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.2.","status":"published","published":"2026-10-22T09:37:33Z","modified":"2026-11-02T19:46:30.63322929Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793204572","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (5 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 5 CVEs. Fixed in 3.3.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-28T16:22:52Z","modified":"2026-11-02T19:46:32.707573166Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793352439","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.5.13-tuxcare.6.","status":"published","published":"2026-10-30T10:27:20Z","modified":"2026-11-02T19:46:33.050496282Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793972800","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 2.6.23.RELEASE-tuxcare.1.","status":"published","published":"2026-11-06T14:46:41Z","modified":"2026-11-06T19:00:02.355834114Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793973459","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.1.5.RELEASE-tuxcare.1.","status":"published","published":"2026-11-06T14:57:40Z","modified":"2026-11-06T19:00:04.404656924Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794219621","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (6 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 6 CVEs. Fixed in 3.1.21.RELEASE-tuxcare.1.","status":"published","published":"2026-11-09T11:20:21Z","modified":"2026-11-09T19:15:04.464662498Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}