CVE-2026-41729
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests. The map key from JSON Pointer is embedded directly into a SpEL expression without sanitization.
Risk Assessment
An attacker can remotely execute arbitrary SpEL expressions, potentially leading to server compromise, data exfiltration, or other unauthorized actions.
Recommendation
Immediately upgrade Spring Data REST to version 3.7.20, 4.3.17, 4.4.15, 4.5.12, or 5.0.6 depending on your branch. If upgrade is not possible, temporarily disable JSON Patch support for maps.
Original NVD description (English source)
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.