ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +1390 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-config MAVEN version =6.3.0, =cloud-0.1, =1.3.0, =1.0.0, =1.2.1 and more Source cves: CVE-2026-47838 Source advisory: MEND:CVE-2026-47838...

cc.chensoul.nacos:nacos-distribution (2.5.2), com.buession.security:buession-security-spring (>=3.0.0, <=3.0.1) +321 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =4.5.0, =4.5.0, =4.5.0, =6.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2026-47838 Source advisory: MEND:CVE-2026-47838...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +1888 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=5.7.0, <=5.7.14)

org.springframework.security:spring-security-config MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=55.v51410e712e0c, <=63.v7e87d06b_a_30c) +2284 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-web MAVEN version =6.4.0, =0.0.1, =55.v51410e712e0c, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =1.0.18 - cc.zzzyu.nacos:nacos-ai 3.1.1 - cc.zzzyu.nacos:nacos-cmdb 3.1.1 - cc.zzzyu.nacos:nacos-config 3.1.1 - cc.zzzyu.nacos:nacos-console...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +2278 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-web MAVEN version =6.3.0, =cloud-0.1, =1.3.0, =1.0.0, =1.2.1 and more Source cves: CVE-2026-47838 Source advisory: MEND:CVE-2026-47838...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +2341 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=5.7.0, <=5.7.14)

org.springframework.security:spring-security-web MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2026-41837...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2026-418...

ai.apiverse:apipulse (1.0.1), ca.denisab85:telegram-restapi (0.0.1) +59 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=3.7.0, <=3.7.18)

org.springframework.data:spring-data-rest-webmvc MAVEN version =3.7.0, =0.4.0, =0.4.0, =0.4.0, =2.1.6, =2.1.6, =2.1.6, =1.1.4.release, =3.0.0, =2.0.0, =5.0.3, =1.0.3, =1.1.2 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2026-41837...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +55 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =2.0.0, =2.0.4 - com.gitlab.mattldulany:sharedresources 2.0.0 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.7 -...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +24 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.0.5, =6.2.1, =6.2.12 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +76 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2026-41837...

CVE-2026-41837

CVE-2026-41837 impacts Spring Data REST where the Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not apply Jackson customizations before passing them to Querydsl. Affected versions include Spring Data REST 3.7.0–3.7.19; 4.3.0–4.3.16; 4.4...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...