CVE-2026-47850mediumCWE-915

CVE-2026-47850: falha de média gravidade em Spring Data REST

Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Data REST

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Spring · Spring Data REST
CVEs relacionadas — Spring Data REST

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41729HIGHSpring Data REST SpEL Injection via Map Key in JSON PatchEPSS 0.4%CVE-2026-47849HIGHSpring Data REST allows mutation of identifier and version properties via JSON PatchEPSS 0.4%CVE-2026-41728HIGHSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsEPSS 0.3%CVE-2026-41730MEDIUMSpring Data REST exposes persistence-layer internals in error responsesEPSS 0.2%CVE-2026-41837MEDIUMSpring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keysEPSS 0.2%