Executive brief
Spring Data REST, a framework used to build web services that interact with databases, contains a vulnerability that may leak sensitive internal information. When an error occurs, the system includes detailed technical data about the database and application structure in its response to the user. This information could be used by an attacker to better understand the internal workings of the system and plan further attacks.
Technical details
Spring Data REST is vulnerable to information exposure (CWE-209) because it serializes the full exception cause chain into HTTP error response bodies. This behavior occurs when an application encounters an error during data persistence operations, causing the framework to return detailed stack traces or internal database metadata to the requester. An unauthenticated remote attacker can trigger these errors through standard HTTP requests to the REST API. This exposure reveals persistence-layer internals, such as database schema details or internal class names, which can facilitate reconnaissance for further exploitation. The issue is addressed in versions 4.5.12 and 5.0.6.
Affected products
- Spring Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released