512 matches found
CVE-2026-41728 Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...
CVE-2026-41728 Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...
ai.apiverse:apipulse (1.0.1), ca.denisab85:telegram-restapi (0.0.1) +59 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-webmvc (>=3.7.0, <=3.7.18)
org.springframework.data:spring-data-rest-webmvc MAVEN version =3.7.0, =0.4.0, =0.4.0, =0.4.0, =2.1.6, =2.1.6, =2.1.6, =1.1.4.release, =3.0.0, =2.0.0, =5.0.3, =1.0.3, =1.1.2 and more Source cves: CVE-2026-41728 Source advisory: MEND:CVE-2026-41728...
com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +29 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0, <=5.0.5)
org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter 4.0.0 -...
br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)
org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41728 Source advisory: MEND:CVE-2026-41728...
com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +55 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-webmvc (>=4.3.0, <=4.3.13)
org.springframework.data:spring-data-rest-webmvc MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =2.0.0, =2.0.4 - com.gitlab.mattldulany:sharedresources 2.0.0 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.7 -...
be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +24 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-webmvc (>=4.4.0, <=4.4.13)
org.springframework.data:spring-data-rest-webmvc MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.0.5, =6.2.1, =6.2.12 and more Source cves: CVE-2026-41728 Source advisory: MEND:CVE-2...
br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +76 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-webmvc (>=4.5.0, <=4.5.11)
org.springframework.data:spring-data-rest-webmvc MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41728 Source advisory: MEND:CVE-2026-41728...
io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.17.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...
org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.3.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...
org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.13.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...
gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release) +5 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.14.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.14.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin...
io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (0.12.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...
org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.3.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...
io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.17.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...
org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.13.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...
gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release) +5 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.14.0.release)
org.springframework.hateoas:spring-hateoas MAVEN version 0.14.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin...
PT-2026-48324
Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5 Descripti...
cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections...