Arbitrary Property Path Vulnerability in Spring Data REST by VMware
CVE-2026-41837

5.3MEDIUM

Key Information:

Vendor

Spring

Status
Spring Data Rest
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41837?

The integration of Querydsl in Spring Data REST permits the use of arbitrary persistent property paths as filter keys through request parameters. This flaw overlooks configurations made through Jackson, which may result in unintended exposure of sensitive information, leading to potential data leaks or unauthorized access. Users of affected versions should prioritize updating their systems to mitigate this vulnerability.

Affected Version(s)

Spring Data REST 3.7.0 < 3.7.20

Spring Data REST 4.3.0 < 4.3.17

Spring Data REST 4.4.0 < 4.4.15

References

https://spring.io/security/cve-2026-41837

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.