Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41837Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
Medium 5.3
In plain English
A medium-severity improper access control in Spring Data REST from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-rest-core | 5.0.6 | GHSA-mwpv-rg79-863c |
| Maven | org.springframework.data:spring-data-rest-core | 4.5.12 | GHSA-mwpv-rg79-863c |
| Maven | org.springframework.data:spring-data-rest-core | no fix listed | GHSA-mwpv-rg79-863c |
| Maven | org.springframework.data:spring-data-rest-core | no fix listed | GHSA-mwpv-rg79-863c |
| Maven | org.springframework.data:spring-data-rest-core | no fix listed | GHSA-mwpv-rg79-863c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Data REST | 3.7.0 – before 3.7.204.3.0 – before 4.3.174.4.0 – before 4.4.154.5.0 – before 4.5.11.15.0.0 – before 5.0.5.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N