SB20260828185 - Multiple vulnerabilities in Spring Data REST

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Neutralization of Special Elements used in an Expression Language Statement (CVE-ID: CVE-2026-41729)

CWE-ID: CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary SpEL expressions.

The vulnerability exists due to improper neutralization of special elements used in an expression language statement in JSON Patch map key processing when handling PATCH requests with application/json-patch+json content. A remote user can send a specially crafted PATCH request with a malicious map-key path segment to execute arbitrary SpEL expressions.

Both read and write patch paths are affected, and exploitation requires that the exposed aggregate or a reachable embedded type declares a map-typed persistent property.

2) Improper access control (CVE-ID: CVE-2026-41728)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify read-only nested properties.

The vulnerability exists due to improper access control in Spring Data REST JSON Patch processing when resolving multi-segment JSON Pointer paths. A remote attacker can send a specially crafted JSON Patch request to modify read-only nested properties.

Affected applications include domain models with an embeddable object, collection, or map property whose container is marked read-only at the Jackson level while the inner element type has no per-field restriction.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-41729
• https://spring.io/security/cve-2026-41728