{"id":"CVE-2026-47850","aliases":["CLSA-2026-1791534183","CLSA-2026-1791988475","CLSA-2026-1791998415","CLSA-2026-1792422770","CLSA-2026-1792429350","CLSA-2026-1792491807","CLSA-2026-1792590681","CLSA-2026-1792661853","CLSA-2026-1792663094","CLSA-2026-1792669133","CLSA-2026-1793191945","CLSA-2026-1793204572","CLSA-2026-1793352439","CLSA-2026-1793972800","CLSA-2026-1793973459","CLSA-2026-1794219621","CLSA-2026-1794402771","EUVD-2026-66820","GHSA-qmj8-w7c8-vhgx"],"status":"published","title":"Spring Data REST allows mutation of the version property of immutable aggregates via PUT","description":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00306,"percentile":0.23675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-915"],"published":"2026-08-26T23:28:40Z","modified":"2026-11-11T19:30:04Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","fixed_in":["4.3.13-tuxcare.10","3.7.16-tuxcare.3","4.3.12-tuxcare.3","3.6.10-tuxcare.3","4.1.8-tuxcare.2","4.0.12-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.13"},{"fixed":"4.3.13-tuxcare.10"}]}],"versions":["4.3.13","4.3.13-tuxcare.1","4.3.13-tuxcare.2","4.3.13-tuxcare.3","4.3.13-tuxcare.4","4.3.13-tuxcare.5","4.3.13-tuxcare.6","4.3.13-tuxcare.7","4.3.13-tuxcare.8","4.3.13-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.18"},{"fixed":"3.7.18-tuxcare.9"}]}],"versions":["3.7.18","3.7.18-tuxcare.1","3.7.18-tuxcare.2","3.7.18-tuxcare.3","3.7.18-tuxcare.4","3.7.18-tuxcare.5","3.7.18-tuxcare.6","3.7.18-tuxcare.7","3.7.18-tuxcare.8","3.7.18.tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.13"},{"fixed":"4.4.13-tuxcare.5"}]}],"versions":["4.4.13","4.4.13-tuxcare.1","4.4.13-tuxcare.2","4.4.13-tuxcare.3","4.4.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.16"},{"fixed":"3.7.16-tuxcare.3"}]}],"versions":["3.7.16","3.7.16-tuxcare.1","3.7.16-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.12"},{"fixed":"4.3.12-tuxcare.3"}]}],"versions":["4.3.12","4.3.12-tuxcare.1","4.3.12-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.9"},{"fixed":"3.4.9-tuxcare.3"}]}],"versions":["3.4.9","3.4.9-tuxcare.1","3.4.9-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.10"},{"fixed":"3.6.10-tuxcare.3"}]}],"versions":["3.6.10","3.6.10-tuxcare.1","3.6.10-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.12"},{"fixed":"3.5.12-tuxcare.2"}]}],"versions":["3.5.12","3.5.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.8"},{"fixed":"4.1.8-tuxcare.2"}]}],"versions":["4.1.8","4.1.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.12"},{"fixed":"4.0.12-tuxcare.2"}]}],"versions":["4.0.12","4.0.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12"},{"fixed":"4.2.12-tuxcare.5"}]}],"versions":["4.2.12","4.2.12-tuxcare.1","4.2.12-tuxcare.2","4.2.12-tuxcare.3","4.2.12-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.5.RELEASE"},{"fixed":"3.3.5.RELEASE-tuxcare.1"}]}],"versions":["3.3.5.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.13"},{"fixed":"4.5.13-tuxcare.6"}]}],"versions":["4.5.13","4.5.13-tuxcare.1","4.5.13-tuxcare.2","4.5.13-tuxcare.3","4.5.13-tuxcare.4","4.5.13-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.23.RELEASE"},{"fixed":"2.6.23.RELEASE-tuxcare.1"}]}],"versions":["2.6.23.RELEASE"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5.RELEASE"},{"fixed":"3.1.5.RELEASE-tuxcare.1"}]}],"versions":["3.1.5.RELEASE"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.21.RELEASE"},{"fixed":"3.1.21.RELEASE-tuxcare.1"}]}],"versions":["3.1.21.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.10.RELEASE"},{"fixed":"3.1.10.RELEASE-tuxcare.2"}]}],"versions":["3.1.10.RELEASE","3.1.10.RELEASE-tuxcare.1"],"bundled":3}],"products":[{"vendor":"spring","product":"spring data rest"},{"vendor":"vmware","product":"spring_data_rest"}],"references":[{"url":"https://spring.io/security/cve-2026-47850","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47850","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qmj8-w7c8-vhgx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47850.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47850","title":"Spring Data REST allows mutation of the version property of immutable aggregates via PUT","description":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-26T23:28:40.729Z","modified":"2026-08-27T15:15:43.277Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66820","description":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-26T23:28:40Z","modified":"2026-08-27T15:15:43Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:27.663452Z"}],"ghsa":[{"id":"GHSA-qmj8-w7c8-vhgx","title":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root...","description":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T03:32:58Z","modified":"2026-08-27T18:32:07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47850","description":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-27T01:17:31.997Z","modified":"2026-09-04T20:07:16.067Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-47850","title":"Spring Data REST allows mutation of the version property of immutable aggregates via PUT","description":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier","status":"published","published":"2026-08-26T23:28:40.729Z","modified":"2026-10-28T02:31:15.012640735Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1791534183","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.13-tuxcare.10.","status":"published","published":"2026-10-09T08:23:03Z","modified":"2026-11-02T19:46:26.651106995Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791988475","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.7.18-tuxcare.9.","status":"published","published":"2026-10-14T14:34:35Z","modified":"2026-11-02T19:46:28.381287453Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1791998415","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 4.4.13-tuxcare.5.","status":"published","published":"2026-10-14T17:20:15Z","modified":"2026-11-02T19:46:28.418423211Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792422770","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.7.16-tuxcare.3.","status":"published","published":"2026-10-19T15:12:50Z","modified":"2026-11-02T19:46:29.711589471Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792429350","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.3.12-tuxcare.3.","status":"published","published":"2026-10-19T17:02:30Z","modified":"2026-11-02T19:46:29.686019224Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792491807","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.4.9-tuxcare.3.","status":"published","published":"2026-10-20T10:23:27Z","modified":"2026-11-02T19:46:30.17204033Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792590681","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 3.6.10-tuxcare.3.","status":"published","published":"2026-10-21T13:51:21Z","modified":"2026-11-02T19:46:29.550403274Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792661853","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 3.5.12-tuxcare.2.","status":"published","published":"2026-10-22T09:37:33Z","modified":"2026-11-02T19:46:30.63322929Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792663094","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.1.8-tuxcare.2.","status":"published","published":"2026-10-22T09:58:14Z","modified":"2026-11-02T19:46:30.688337447Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792669133","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 1 CVE. Fixed in 4.0.12-tuxcare.2.","status":"published","published":"2026-10-22T11:38:53Z","modified":"2026-11-02T19:46:30.451723364Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793191945","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.2.12-tuxcare.5.","status":"published","published":"2026-10-28T12:52:25Z","modified":"2026-11-02T19:46:32.651035215Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793204572","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (5 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 5 CVEs. Fixed in 3.3.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-28T16:22:52Z","modified":"2026-11-02T19:46:32.707573166Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793352439","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (2 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 2 CVEs. Fixed in 4.5.13-tuxcare.6.","status":"published","published":"2026-10-30T10:27:20Z","modified":"2026-11-02T19:46:33.050496282Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793972800","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 2.6.23.RELEASE-tuxcare.1.","status":"published","published":"2026-11-06T14:46:41Z","modified":"2026-11-06T19:00:02.355834114Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793973459","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 4 CVEs. Fixed in 3.1.5.RELEASE-tuxcare.1.","status":"published","published":"2026-11-06T14:57:40Z","modified":"2026-11-06T19:00:04.404656924Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794219621","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (6 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 6 CVEs. Fixed in 3.1.21.RELEASE-tuxcare.1.","status":"published","published":"2026-11-09T11:20:21Z","modified":"2026-11-09T19:15:04.464662498Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794402771","title":"TuxCare security update for org.springframework.data:spring-data-rest-core (3 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-rest-core to address 3 CVEs. Fixed in 3.1.10.RELEASE-tuxcare.2.","status":"published","published":"2026-11-11T14:12:51Z","modified":"2026-11-11T19:30:04.694871984Z","updated_at":"2026-11-11T19:50:24.684142Z"}]}}