PatchTheCVEspring data rest vulnerabilities and fixes
Recent CVEs affecting spring data rest, with upgrade or downgrade steps. 2 tracked.
Also searched as: springdatarest.
spring data rest has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-27. Highest priority: CVE-2026-47849 (score 32/100).
- CVE-2026-47850 MEDIUM 4.3 UPGRADE Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handlin
- CVE-2026-47849 HIGH 7.1 UPGRADE Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 69
FAQ
How do I fix spring data rest vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring data rest being exploited right now?
None of the tracked spring data rest CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring data rest CVE should I patch first?
CVE-2026-47849 currently ranks highest (32/100): Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 69.