PT-2026-48329

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5 Descripti...

cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys...

CVE-2024-49203

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...

GHSA-6Q3Q-6V5J-H6VG Querydsl vulnerable to HQL injection through orderBy

Summary The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repositoryhttps://github.com/querydsl/querydsl whe...

com.querydsl:querydsl-collections (4.0.0), com.querydsl:querydsl-hibernate-search (4.0.0) +5 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.0)

com.querydsl:querydsl-apt MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.0 - com.querydsl:querydsl-hibernate-search 4.0.0 -...

com.querydsl:querydsl-collections (4.0.1), com.querydsl:querydsl-hibernate-search (4.0.1) +5 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.1)

com.querydsl:querydsl-apt MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.1 - com.querydsl:querydsl-hibernate-search 4.0.1 -...

com.querydsl:querydsl-collections (4.0.3), com.querydsl:querydsl-hibernate-search (4.0.3) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.3)

com.querydsl:querydsl-apt MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.3 - com.querydsl:querydsl-hibernate-search 4.0.3 -...

com.querydsl:querydsl-collections (4.0.6), com.querydsl:querydsl-hibernate-search (4.0.6) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.6)

com.querydsl:querydsl-apt MAVEN version 4.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.6 - com.querydsl:querydsl-hibernate-search 4.0.6 -...

com.querydsl:querydsl-collections (4.0.7), com.querydsl:querydsl-hibernate-search (4.0.7) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.7)

com.querydsl:querydsl-apt MAVEN version 4.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.7 - com.querydsl:querydsl-hibernate-search 4.0.7 -...

com.querydsl.contrib:querydsl-dynamodb (4.0.8), com.querydsl.contrib:querydsl-elasticsearch (4.0.8) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.8)

com.querydsl:querydsl-apt MAVEN version 4.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl.contrib:querydsl-dynamodb 4.0.8 - com.querydsl.contrib:querydsl-elasticsearch 4.0.8 -...

com.querydsl:querydsl-collections (4.0.9), com.querydsl:querydsl-hibernate-search (4.0.9) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.0.9)

com.querydsl:querydsl-apt MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.0.9 - com.querydsl:querydsl-hibernate-search 4.0.9 -...

com.querydsl:querydsl-collections (4.1.0), com.querydsl:querydsl-hibernate-search (4.1.0) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.1.0)

com.querydsl:querydsl-apt MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.1.0 - com.querydsl:querydsl-hibernate-search 4.1.0 -...

com.querydsl:querydsl-collections (4.1.2), com.querydsl:querydsl-hibernate-search (4.1.2) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.1.2)

com.querydsl:querydsl-apt MAVEN version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.1.2 - com.querydsl:querydsl-hibernate-search 4.1.2 -...

br.ufsc.bridge:querydsl-utils (1.1.1), com.coreoz:plume-db-hibernate (1.0.0-beta3) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.1.3)

com.querydsl:querydsl-apt MAVEN version 4.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - br.ufsc.bridge:querydsl-utils 1.1.1 - com.coreoz:plume-db-hibernate 1.0.0-beta3 -...

cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-jpa-hibernate-conf (>=3.0.0.release, <=3.0.1.release), cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-mongodb-conf (>=3.0.0.release, <=3.0.1.release) +71 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.1.4)

com.querydsl:querydsl-apt MAVEN version 4.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-jpa-hibernate-conf =3.0.0.release,...

com.querydsl:querydsl-collections (4.2.0), com.querydsl:querydsl-hibernate-search (4.2.0) +6 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.2.0)

com.querydsl:querydsl-apt MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.2.0 - com.querydsl:querydsl-hibernate-search 4.2.0 -...

be.mogo.generator:mogo-generator-model (1.0.0.release), be.mogo.iam:mogo-provisioning (>=1.0.2.release, <=1.1.7.release) +70 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.2.1)

com.querydsl:querydsl-apt MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - be.mogo.generator:mogo-generator-model 1.0.0.release - be.mogo.iam:mogo-provisioning =1.0.2.release,...

br.ufsc.bridge:querydsl-utils (1.1.3), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +51 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.2.2)

com.querydsl:querydsl-apt MAVEN version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - br.ufsc.bridge:querydsl-utils 1.1.3 - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation...

com.github.yunwjr:yun-util-examples (>=0.0.28, <=0.0.29), com.github.yunwjr:yun-util-querydsl (>=0.0.28, <=0.0.29) +8 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.3.0)

com.querydsl:querydsl-apt MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.github.yunwjr:yun-util-examples =0.0.28, =0.0.28, =0.0.29 - com.querydsl:querydsl-collections 4.3.0 -...

be.personify.iam:personify-scim-server (1.2.2.release), com.capitalone.dashboard:hygieia-common (>=4.0.1, <=4.1.0) +71 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.3.1)

com.querydsl:querydsl-apt MAVEN version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - be.personify.iam:personify-scim-server 1.2.2.release - com.capitalone.dashboard:hygieia-common =4.0.1, =1.0.1...