org.springframework.data:spring-data-rest-webmvc (2.3.1.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.3.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

com.buession.cas:cas-server-support-logging (>=3.0.0, <=3.0.1), com.buession.cas:cas-server-support-logging-core (>=3.0.0, <=3.0.1) +101 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=2.9.0, <=2.9.13)

org.springframework.kafka:spring-kafka MAVEN version =2.9.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.1.34, =1.3.0, =1.1.3, =1.2.3 - com.infobip.kafkistry:kafkistry-app 0.3.0 - com.infobip.kafkistry:kafkistry-auditing 0.3.0 - com.infobip.kafkistry:kafkistry-consume 0.3.0 -...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.upers:betexdao (>=1.0.0, <=1.2.7), com.nepxion:discovery-common-redis (>=edgware.1.0.0, <=3.14.0) +13 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.17.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.upers:betexdao =1.0.0, =edgware.1.0.0,...

EUVD-2026-35910

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +391 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

GHSA-5M4M-73W9-8433 Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

com.blibli.oss:kafka-plugin (>=0.0.1, <=2.1.0), com.github.cirola2000:idol-metadata (0.0.1) +65 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.1.7.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.blibli.oss:kafka-plugin =0.0.1, =0.0.5, =1.3.0.release, =1.3.0.release,...

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

org.springframework.boot:spring-boot-starter-data-rest (1.4.6.release), org.springframework.data:spring-data-rest-hal-browser (2.5.10.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.5.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.jsondoc:jsondoc-springmvc (>=1.2.14, <=1.2.23), org.springframework.data:spring-data-rest-hal-browser (2.5.1.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.jsondoc:jsondoc-springmvc =1.2.14, =1.2.23 -...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +455 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

com.thinkbiganalytics.kylo.plugins:kylo-hadoop-authorization-ranger (>=0.8.3, <=0.9.1), com.thinkbiganalytics.kylo.plugins:kylo-ranger-rest-client (>=0.8.3, <=0.9.1) +33 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: -...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41837 Source advisory: OSV:GHSA-MWPV-RG7...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +368 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0.2, =1.0.2, =a.1.0.0,...

com.github.skyding228:spring-session-redis (1.0), net.mingsoft:ms-base (>=1.0.3, <=1.0.8) +14 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.10.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.skyding228:spring-session-redis 1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.1, <=2.5), com.github.vencent-lu:giants-cache-redis (>=1.0.4, <=1.0.5-beta-7) +80 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.4.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.1, =1.0.4, =2.2.1...