HIGH | JUNE 09, 2026 | CVE-2026-41729
Description
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests.
When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. An attacker who can issue PATCH requests against an affected endpoint can craft a map-key segment that breaks out of the intended indexer literal and evaluates an arbitrary SpEL sub-expression within the context of the aggregate root.
Both the read and write patch paths are affected.
Preconditions:
- The exposed aggregate or a nested embedded type reachable via the patch path declares a
Map-typed persistent property. - The attacker is able to issue
PATCHrequests withContent-Type: application/json-patch+jsonto the item resource (enabled by default; authentication requirements depend on the application's security configuration).
Affected Spring Products and Versions
Spring Data REST:
- 3.7.0 - 3.7.19
- 4.3.0 - 4.3.16
- 4.4.0 - 4.4.14
- 4.5.0 - 4.5.11
- 5.0.0 - 5.0.5
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 3.7.x | 3.7.20 | Commercial |
| 4.3.x | 4.3.17 | Commercial |
| 4.4.x | 4.4.15 | Commercial |
| 4.5.x | 4.5.12 | OSS |
| 5.0.x | 5.0.6 | OSS |
Credit
The issue was identified and responsibly reported by Daehyun Kang (@daehyuh) [email protected].
References
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy