org.springframework.data:spring-data-rest-hal-browser (2.4.6.release), org.springframework.data:spring-data-rest-webmvc (2.4.6.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.1.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

com.epam.reportportal:commons-bugtracking (2.7.0), com.epam.reportportal:commons-dao (>=2.7.0, <=2.7.1.1) +41 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.3.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.epam.reportportal:commons-bugtracking 2.7.0 -...

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

GHSA-J388-8RM5-P97F Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

com.github.upers:betexdao (>=1.0.0, <=1.2.7), com.nepxion:discovery-common-redis (>=edgware.1.0.0, <=3.14.0) +13 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.17.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.upers:betexdao =1.0.0, =edgware.1.0.0,...

EUVD-2026-35901

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-...

com.ecfront.dew:cluster-spi-redis (1.2.2-rc), com.ecfront.dew:test-starter (1.2.2-rc) +45 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.6.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.ecfront.dew:cluster-spi-redis 1.2.2-rc -...

org.springframework.boot:spring-boot-starter-data-rest (1.5.17.release), org.springframework.data:spring-data-rest-hal-browser (2.6.16.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.16.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41729 Source advisory: OSV:GHSA-J388-8RM5-P97F...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41729 Source advisory: OSV:GHSA-J388-8RM5-P97Fhttps://vulners.c...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-8RM5-P9...

org.springframework.boot:spring-boot-starter-data-rest (1.4.7.release), org.springframework.data:spring-data-rest-hal-browser (2.5.11.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), org.springframework.boot:spring-boot-starter-data-rest (1.4.3.release) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.2.0 -...

org.springframework.data:spring-data-rest-webmvc (2.3.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.3.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +1038 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-keyvalue MAVEN version =3.5.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.3 - cc.uncarbon.framework:helio-starter-rate-limit-redis 2.5.0 - cc.uncarbon.framework:helio-starter-redis 2.5...

org.springframework.data:spring-data-rest-webmvc (2.3.2.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.3.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

am.ik.home:uaa-server (1.9.0), com.github.ddewaele:springboot.crud.sample (0.0.10) +3 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server 1.9.0 -...