PT-2026-48325

CVE-2026-41729

Published

2026-06-09

Updated

2026-09-16

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5

Description Spring Data REST is susceptible to Spring Expression Language (SpEL) injection when processing JSON Patch requests using the application/json-patch+json content type. This occurs when a persistent entity exposes a Map-typed property, as the JSON Pointer path segment serving as the map key is embedded into a SpEL expression without proper sanitization or validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Researchers

Daehyuh

Daehyun Kang

Vendors

Affected products

Weakness enumeration

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (\'Expression Language Injection\')

Related identifiers

CVE-2026-41729