CVE-2026-47850

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.3) +32 more potentially affected by CVE-2026-47850 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0, <=5.0.6)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =7.0.3, =7.0.3, =7.0.3, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 and more Source cves: CVE-2026-47850 Source advisory: MEND...

CVE-2026-47834

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

app.tozzi:jpa-search-helper (4.1.0), br.com.archbase:archbase-domain-driven-design (>=3.0.0, <=3.4.2) +885 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (4.1.0)

org.springframework.data:spring-data-jpa MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-jpa and may be impacted: - app.tozzi:jpa-search-helper 4.1.0 - br.com.archbase:archbase-domain-driven-desi...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

EUVD-2026-66676

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834 Spring Data JPA Sort expression validation bypass

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2026-47834

CVE-2026-47834 affects Spring Data JPA versions 4.1.0 , 4.0.0–4.0.6 , 3.5.0–3.5.13 , and 3.0.0–3.4.15 . The vulnerability allows bypass of Sort expression validation when crafted payloads are accepted from untrusted sources, potentially leading to low confidentiality and low availability impact. ...

CVE-2026-47834: Undefined Security Weakness

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

PT-2026-82245

Name of the Vulnerable Software and Affected Versions Spring Data JPA version 4.1.0 Spring Data JPA versions 4.0.0 through 4.0.6 Spring Data JPA versions 3.5.0 through 3.5.13 Spring Data JPA versions 3.0.0 through 3.4.15 Description Sort validation can be bypassed when parameters containing craft...

PT-2026-82348

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.20 and earlier Spring Data REST versions 4.0.0 through 4.4.15 Spring Data REST versions 4.5.0 through 4.5.12 Spring Data REST versions 5.0.0 through 5.0.6 Spring Data REST version 5.1.0 Description An issue exists...

K000163049: Spring Data Commons vulnerability CVE-2026-41695

Security Advisory Description Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0...

CLSA-2026-1787403789 TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.3.13-tuxcare.3...

br.com.archbase:archbase-starter (>=3.0.0, <=3.1.8), br.com.archbase:archbase-starter-core (>=3.0.0, <=3.1.8) +31 more potentially affected by CVE-2026-47849 via org.springframework.data:spring-data-rest-core (5.1.0)

org.springframework.data:spring-data-rest-core MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - br.com.archbase:archbase-starter =3.0.0, =3.0.0, =3.0.2, =3.0.2,...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.3) +34 more potentially affected by CVE-2026-47849 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.6)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =7.0.3, =7.0.3, =7.0.3, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 and more Source cves: CVE-2026-47849 Source advisory: SNYK:...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.7.5) +4134 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (>=3.0.0, <=4.0.6)

org.springframework.data:spring-data-jpa MAVEN version =3.0.0, =0.1.0, =0.6.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47834 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-19267482...

app.tozzi:jpa-search-helper (4.1.0), br.com.archbase:archbase-domain-driven-design (>=3.0.0, <=3.4.2) +885 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (4.1.0)

org.springframework.data:spring-data-jpa MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-jpa and may be impacted: - app.tozzi:jpa-search-helper 4.1.0 - br.com.archbase:archbase-domain-driven-desi...