CVE-2026-41729

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5

Description Spring Data REST is susceptible to Spring Expression Language (SpEL) injection when processing JSON Patch requests using the application/json-patch+json content type. This occurs when a persistent entity exposes a Map-typed property, as the JSON Pointer path segment serving as the map key is embedded into a SpEL expression without proper sanitization or validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.