Improper control of a resource through its lifetime in Spring Data REST - CVE-2026-47850
Published: August 28, 2026
Vulnerability identifier: #VU146271
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47850
CWE-ID: CWE-664
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to overwrite concurrent updates.
The vulnerability exists due to improper preservation of the version property in HTTP PUT handling for immutable aggregate roots when processing PUT requests against immutable target types. A remote user can submit a crafted request body containing a version value to overwrite concurrent updates.
The issue affects immutable aggregate types such as Java records, Kotlin data classes, all-args @PersistenceCreator types, and cases involving a body-driven polymorphic subtype change. Applications are affected when the version property is visible to Jackson deserialization and is not excluded via @JsonIgnore.
Affected software
Spring Data REST
How to mitigate CVE-2026-47850
Install security update from vendor's website.
Spring Data REST - addressed in versions 3.7.21, 4.4.16, 4.5.13, 5.0.6.1, 5.0.7, 5.1.0.1, 5.1.1