GHSA-MWPV-RG79-863C Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

com.github.dcsolutions.kalinka:kalinka-pub (>=0.0.1, <=0.0.10), com.github.dcsolutions.kalinka:kalinka-pub-plugin (>=0.0.1, <=0.0.10) +13 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.dcsolutions.kalinka:kalinka-pub =0.0.1, =0.0.1, =0.0.2, =0.0.1,...

com.aol.microservices:microserver-boot (>=0.53.1, <=0.59), com.aol.microservices:microserver-core (>=0.5, <=0.59) +88 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.9.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:microserver-boot =0.53.1, =0.5,...

com.huaweicloud.dis:huaweicloud-dis-spring-kafka (>=1.1.2, <=1.2.21), com.tencent.bk.devops.ci.common:common-kafka (>=1.3.0-rc.7-release, <=1.3.1-release-release) +3 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.8.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.huaweicloud.dis:huaweicloud-dis-spring-kafka =1.1.2, =1.3.0-rc.7-releas...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.9, <=0.0.11), com.github.paulcwarren:spring-content-rest (>=0.0.9, <=0.0.11) +7 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:content-rest-spring-boot-starter...

org.apache.skywalking:apm-spring-kafka-1.x-plugin (>=8.3.0, <=9.6.0) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.11.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.apache.skywalking:apm-spring-kafka-1.x-plugin =8.3.0, =9.6.0 Source...

com.github.codinghck:utils (1.1.1-release), com.twosigma.webtau:webtau-docs (>=1.16, <=1.20) +17 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.7.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codinghck:utils 1.1.1-release -...

com.sap.research.security.vulas:rest-backend (>=3.1.6, <=3.1.15), org.sakaiproject.edu-services.gradebook:gradebook-service-impl (>=20.0, <=20.6) +6 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.23.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.sap.research.security.vulas:rest-backend =3.1.6, =20.0...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41729 Source advisory: OSV:GHSA-J388-8RM5-P97Fhttps://vulners.c...

EUVD-2026-35903

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

ca.bc.gov.tno:service (>=0.0.1-alpha, <=0.0.6-alpha), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +743 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.0.0.release, <=2.8.11)

org.springframework.kafka:spring-kafka MAVEN version =2.0.0.release, =0.0.1-alpha, =1.0.4.r, =3.0.0.release, =3.0.0.release, =1.0.1, =0.0.1, =1.0.1, =0.0.2, =1.0.0, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41727 Source advisory: OSV:GHSA-53W6-V7CV-FC9H...

org.springframework.boot:spring-boot-starter-data-rest (1.5.20.release), org.springframework.data:spring-data-rest-hal-browser (2.6.20.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.20.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.cloud:spring-cloud-starter-stream-kafka11 (1.3.0.release), org.springframework.cloud:spring-cloud-stream-binder-kafka-0.11-test (1.3.0.release) +5 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-stream-kafka11 1.3.0.release...

org.springframework.data:spring-data-rest-hal-browser (2.5.4.release), org.springframework.data:spring-data-rest-webmvc (2.5.4.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.boot:spring-boot-starter-data-rest (1.5.20.release), org.springframework.data:spring-data-rest-hal-browser (2.6.20.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.20.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

cn.dyaoming.common:common-cache (0.0.2), com.github.fosin:cdp-core (1.0.0.release) +100 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.15.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.dyaoming.common:common-cache 0.0.2 -...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory: OSV:GHSA-MWPV-RG79-863C...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-8RM5-P97Fhttps://vulners.com/g...

in.clouthink.daas:daas-bm-core (>=1.0.0, <=1.0.3), in.clouthink.daas:daas-bm-mongodb (>=1.0.0, <=1.0.3) +28 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.7.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - in.clouthink.daas:daas-bm-core =1.0.0, =1.0.0, =3.0.1, =1.0.0,...