Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41729Spring Data REST SpEL Injection via Map Key in JSON Patch
High 8.1
In plain English
A high-severity expression language injection in Spring Data REST from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-rest-core | 5.0.6 | GHSA-j388-8rm5-p97f |
| Maven | org.springframework.data:spring-data-rest-core | 4.5.12 | GHSA-j388-8rm5-p97f |
| Maven | org.springframework.data:spring-data-rest-core | no fix listed | GHSA-j388-8rm5-p97f |
| Maven | org.springframework.data:spring-data-rest-core | no fix listed | GHSA-j388-8rm5-p97f |
| Maven | org.springframework.data:spring-data-rest-core | no fix listed | GHSA-j388-8rm5-p97f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Data REST | 3.7.0 – before 3.7.204.3.0 – before 4.3.174.4.0 – before 4.4.154.5.0 – before 4.5.125.0.0 – before 5.0.6 |
Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N