Improper Neutralization of Special Elements used in an Expression Language Statement in Spring Data REST - CVE-2026-41729
Published: August 28, 2026
Vulnerability identifier: #VU146268
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41729
CWE-ID: CWE-917
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SpEL expressions.
The vulnerability exists due to improper neutralization of special elements used in an expression language statement in JSON Patch map key processing when handling PATCH requests with application/json-patch+json content. A remote user can send a specially crafted PATCH request with a malicious map-key path segment to execute arbitrary SpEL expressions.
Both read and write patch paths are affected, and exploitation requires that the exposed aggregate or a reachable embedded type declares a map-typed persistent property.
Affected software
Spring Data REST
How to mitigate CVE-2026-41729
Install security update from vendor's website.
Spring Data REST - addressed in versions 3.7.20, 4.3.17, 4.4.15, 4.5.12, 5.0.6