Vulnerabilities

TI-2026-30247 CVE-2026-41837 · GHSA-mwpv-rg79-863c

Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

LOW 29

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00191 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +5 CWE-284

TI-2026-30244 CVE-2026-41730 · GHSA-p5mm-xwgq-whfr

Spring Data REST exposes persistence-layer internals in error responses

LOW 29

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00197 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +5 CWE-209

TI-2026-30242 CVE-2026-41728 · GHSA-cv39-x4c6-hhp2

Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

LOW 39

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00306 Published 2026-06-09 Fixed in 3.7.20, 4.3.17 +5 CWE-284

Vulnerabilities

Filters

Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections