GHSA-5M4M-73W9-8433 Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

EUVD-2026-35905

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

GHSA-P5MM-XWGQ-WHFR Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

ai.apiverse:apipulse (1.0.1), app.commerce-io:spring-boot-starter-data-search-jpa (>=1.1.0-rc1, <=1.3.0) +385 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=3.0.0.release, <=3.7.18)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.release, =1.1.0-rc1, =1.0.1.release, =1.0.0.release, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0, =1.4.0, =1.6.0 - co.bittub.api:core 1.0.0 - com.9isuper.pelecanus:pelecanus-data-jpa 1.0.3.m1 -...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-8RM5-P9...

org.springframework.boot:spring-boot-starter-data-elasticsearch (>=1.1.11.release, <=1.1.12.release), org.springframework.boot:spring-boot-starter-data-jpa (>=1.1.11.release, <=1.1.12.release) +22 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.8.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.boot:spring-boot-starter-data-elasticsearch...

org.springframework.boot:spring-boot-starter-data-rest (>=1.5.11.release, <=1.5.12.release), org.springframework.data:spring-data-rest-hal-browser (2.6.11.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.hushengte:disciples-feed (1.0.5), com.github.paulcwarren:spring-content-rest (>=0.0.3, <=0.0.4) +4 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.hushengte:disciples-feed 1.0.5 -...

org.springframework.data:spring-data-rest-webmvc (2.3.1.release) potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.3.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

ai.apiverse:apipulse (1.0.1), app.commerce-io:spring-boot-starter-data-search-jpa (>=1.1.0-rc1, <=1.3.0) +385 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=3.0.0.release, <=3.7.18)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.release, =1.1.0-rc1, =1.0.1.release, =1.0.0.release, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0, =1.4.0, =1.6.0 - co.bittub.api:core 1.0.0 - com.9isuper.pelecanus:pelecanus-data-jpa 1.0.3.m1 -...

am.ik.home:uaa-server (1.9.0), com.github.ddewaele:springboot.crud.sample (0.0.10) +3 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server 1.9.0 -...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.beta6, <=1.1.0.cr1), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.beta6, <=1.1.0.cr1) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.0.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.beta...

org.springframework.data:spring-cql (1.4.9.release), org.springframework.data:spring-data-cassandra (1.4.9.release) +13 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.9.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.4.9.release -...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.9, <=0.0.11), com.github.paulcwarren:spring-content-rest (>=0.0.9, <=0.0.11) +7 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:content-rest-spring-boot-starter...

com.eworkcloud:ework-cloud-starter-oss (>=1.0.3, <=1.0.9), com.eworkcloud:ework-cloud-starter-redis (>=1.0.0, <=1.8.6) +13 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.20.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.eworkcloud:ework-cloud-starter-oss =1.0.3, =1.0.0, =1.0....

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +1038 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-keyvalue MAVEN version =3.5.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.3 - cc.uncarbon.framework:helio-starter-rate-limit-redis 2.5.0 - cc.uncarbon.framework:helio-starter-redis 2.5...

cn.easyproject:easyshiro-redis-cache (2.6.0-release), com.acmtc:acmtc-redismq (>=1.0.0-release, <=1.0.1-release) +49 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.9.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.easyproject:easyshiro-redis-cache 2.6.0-release -...