CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-41729	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_data_rest::::::::
	cpe:2.3:a:vmware:spring_data_rest::::::::
	cpe:2.3:a:vmware:spring_data_rest::::::::
	cpe:2.3:a:vmware:spring_data_rest::::::::
	cpe:2.3:a:vmware:spring_data_rest::::::::

History

No history.

Information

Published : 2026-06-10 00:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-41729

Mitre link : CVE-2026-41729

CVE.ORG link : CVE-2026-41729

JSON object : View

Products Affected

vmware

spring_data_rest

CWE

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

{"id": "CVE-2026-41729", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41729", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Data REST", "versions": [{"status": "affected", "version": "3.7.0", "lessThan": "3.7.20", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.17", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.15", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.12", "versionType": "custom"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-10T00:16:52.367", "references": [{"url": "https://spring.io/security/cve-2026-41729", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-917"}]}], "descriptions": [{"lang": "en", "value": "Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.\n\nAffected versions:\nSpring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5."}, {"lang": "es", "value": "Spring Data REST es vulnerable a la inyecci\u00f3n de expresiones SpEL a trav\u00e9s de propiedades de tipo mapa al procesar solicitudes de Parche JSON (application/json-patch+json). Cuando una entidad persistente expone una propiedad de tipo Mapa, el segmento de ruta del puntero JSON utilizado como clave del mapa se incrusta directamente en una expresi\u00f3n SpEL sin saneamiento ni validaci\u00f3n.\n\nVersiones afectadas:\nSpring Data REST 3.7.0 a 3.7.19; 4.3.0 a 4.3.16; 4.4.0 a 4.4.14; 4.5.0 a 4.5.11; 5.0.0 a 5.0.5."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5AB0CD7-F756-4FCA-A328-B0F19CBDABD6", "versionEndExcluding": "3.7.20", "versionStartIncluding": "3.7.0"}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FA3D040-BCC5-4C66-A0AF-5383AC89048E", "versionEndExcluding": "4.3.17", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEEF0B3D-C5D9-496A-B300-86876DE9F3B7", "versionEndExcluding": "4.4.15", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40757E5D-97AF-4680-A7F6-2EB1FD09D39E", "versionEndExcluding": "4.5.11.1", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42C8C99B-7F57-4CEE-859A-C6A005C23EFB", "versionEndExcluding": "5.0.5.1", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}