CVE-2026-41837

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5

Description The Querydsl integration in Spring Data REST accepts arbitrary persistent property paths as request-parameter filter keys. This occurs because the system does not consider Jackson customizations—which are used to control how data is serialized or hidden—before passing the keys to Querydsl, potentially exposing persistent fields that were intended to be hidden.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.