ca.bc.gov.tno:service (>=0.0.1-alpha, <=0.0.6-alpha), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +743 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.0.0.release, <=2.8.11)

org.springframework.kafka:spring-kafka MAVEN version =2.0.0.release, =0.0.1-alpha, =1.0.4.r, =3.0.0.release, =3.0.0.release, =1.0.1, =0.0.1, =1.0.1, =0.0.2, =1.0.0, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41727 Source advisory: GHSA-53W6-V7CV-FC9H...

EUVD-2026-35910

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

cn.net.vidyo:jsmth-data (3.3.120.release), com.github.vencent-lu:giants-cache-redis (>=1.0.4, <=1.0.5-beta-7) +4 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release -...

com.ifrabbit:spring-boot-starter-data-mybatis (1.0.17.release), com.ifrabbit:spring-data-mybatis (1.0.17.release) +28 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ifrabbit:spring-boot-starter-data-mybatis 1.0.17.release -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +391 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

in.clouthink.daas:daas-bm-core (>=1.0.0, <=1.0.3), in.clouthink.daas:daas-bm-mongodb (>=1.0.0, <=1.0.3) +28 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.7.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - in.clouthink.daas:daas-bm-core =1.0.0, =1.0.0, =3.0.1, =1.0.0,...

com.github.pscosta:kafka-proto-api (1.0), org.apereo.cas:cas-server-core-configuration-cloud-kafka (5.2.0-rc4) +1 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.pscosta:kafka-proto-api 1.0 -...

com.ueboot:ueboot-generator (2.2.0), com.ueboot:ueboot-shiro (2.2.0) +13 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.15.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ueboot:ueboot-generator 2.2.0 - com.ueboot:ueboot-shir...

GHSA-5M4M-73W9-8433 Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

EUVD-2026-35905

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

GHSA-P5MM-XWGQ-WHFR Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

GHSA-XQ69-5H5V-X9X4 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.liuzhongkai:spider-boot-restdoc (>=2.3.0-release, <=2.3.1-release), com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.6, <=0.0.8) +10 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.liuzhongkai:spider-boot-restdoc =2.3.0-release,...

org.springframework.data:spring-data-rest-hal-browser (2.4.0.release), org.springframework.data:spring-data-rest-webmvc (2.4.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

com.eworkcloud:ework-cloud-starter-oss (>=1.0.3, <=1.0.9), com.eworkcloud:ework-cloud-starter-redis (>=1.0.0, <=1.8.6) +13 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.20.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.eworkcloud:ework-cloud-starter-oss =1.0.3, =1.0.0, =1.0....