CVE-2026-41729: VMware Spring Data REST SpEL injection in JSON Patch processing

CVE-2026-41729 · Severity: high · CVSS 8.1 · Published 2026-06-10

Spring Data REST is a framework used to build web services that interact with databases. A security flaw exists where the system incorrectly processes certain update requests (JSON Patch) involving map-based data. An attacker with basic user access could exploit this to execute unauthorized commands or access sensitive information, potentially leading to a significant data breach.

Technologies: org.springframework.data:spring-data-rest-core (Maven), VMware Spring Data REST. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41729 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41729 being exploited in the wild.
How severe is CVE-2026-41729?
High severity, with a CVSS score of 8.1, published 10 June 2026.
Which products and versions are affected?
org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5, 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Is there a fix for CVE-2026-41729?
Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41729 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41729?
Check whether you run org.springframework.data:spring-data-rest-core (Maven) or VMware Spring Data REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later
    # set org.springframework.data:spring-data-rest-core to 5.0.6 in your pom.xml or build.gradle

Technical details

Spring Data REST is vulnerable to Spring Expression Language (SpEL) injection (CWE-917) when processing 'application/json-patch+json' requests. The vulnerability occurs when a persistent entity exposes a Map-typed property; the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without proper sanitization or validation. A remote attacker with low privileges can send a specially crafted JSON Patch request to execute arbitrary SpEL expressions. This can lead to unauthorized data access or modification. Patches are available in versions 4.5.12 and 5.0.6.

Affected products

  • Spring Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5

Identifiers

  • CVE-2026-41729
  • GHSA-j388-8rm5-p97f

Timeline

  • 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released
  • 2026-06-10: disclosed: Initial advisory publication
  • 2026-08-12: advisory: Advisory updated by GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.