VMware Spring Data Rest vulnerabilities

12 CVEs affecting VMware Spring Data Rest, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47849, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1273: VMware Tanzu Spring Data Commons Property Binder Vulnerability, published 2018-04-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 97% chance of exploitation in the next 30 days. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An…
CVE-2017-8046, published 2018-01-04. Critical severity, CVSS 9.8. EPSS: 74.5% chance of exploitation in the next 30 days. Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use…
CVE-2018-1259, published 2018-05-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper…
CVE-2018-1274, published 2018-04-18. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated…
CVE-2021-22047, published 2021-10-28. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller…
CVE-2022-31679, published 2022-09-21. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure…
CVE-2026-41729, published 2026-06-10. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a…
CVE-2026-47849, published 2026-08-27. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data…
CVE-2026-41728, published 2026-06-10. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected…
CVE-2026-41730, published 2026-06-10. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST…

Latest

CVE-2026-47850, published 2026-08-27. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST…
CVE-2026-41837, published 2026-06-10. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to…