CVE-2026-47849highCWE-915

CVE-2026-47849: falha de alta gravidade em Spring Data REST

Spring Data REST allows mutation of identifier and version properties via JSON Patch

Publicada em

Seguir esta CVE+ Monitorar Spring Data REST

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Produtos afetados
Spring · Spring Data REST
CVEs relacionadas — Spring Data REST

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41729HIGHSpring Data REST SpEL Injection via Map Key in JSON PatchEPSS 0.4%CVE-2026-47850MEDIUMSpring Data REST allows mutation of the version property of immutable aggregates via PUTEPSS 0.3%CVE-2026-41728HIGHSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsEPSS 0.3%CVE-2026-41730MEDIUMSpring Data REST exposes persistence-layer internals in error responsesEPSS 0.2%CVE-2026-41837MEDIUMSpring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keysEPSS 0.2%