com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter 4.0.0 -...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41837 Source advisory: OSV:GHSA-M...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

am.ik.home:uaa-server (1.9.0), com.github.ddewaele:springboot.crud.sample (0.0.10) +3 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server 1.9.0 -...

com.ueboot:ueboot-generator (2.2.0), com.ueboot:ueboot-shiro (2.2.0) +13 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.15.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ueboot:ueboot-generator 2.2.0 - com.ueboot:ueboot-shir...

org.springframework.boot:spring-boot-starter-data-rest (1.5.5.release), org.springframework.data:spring-data-rest-hal-browser (2.6.5.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-...

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +76 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2026-41837...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +55 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =2.0.0, =2.0.4 - com.gitlab.mattldulany:sharedresources 2.0.0 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.7 -...