High

SpEL expression injection in Spring Data REST JSON Patch map-typed properties

IdentifiersCVE-2026-41729CWE-917· Improper Neutralization of Special…

CVE-2026-41729 is a high-severity expression injection vulnerability in Spring Data REST. When processing JSON Patch requests with Content-Type application/json-patch+json, Spring Data REST embeds a JSON Pointer path segment used as a Map key directly into a SpEL expression without sanitization or validation. If a persistent entity, or a reachable embedded type, exposes a Map-typed property, an attacker can craft a patch path whose map-key segment breaks out of the intended literal/indexer context and causes evaluation of attacker-controlled SpEL sub-expressions in the aggregate root context. Both the read patch path and write patch path are affected. Reported affected versions are Spring Data REST 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5; unsupported versions are also stated to be affected.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows attacker-controlled SpEL evaluation in the context of the targeted aggregate root during JSON Patch processing. Depending on the application configuration and reachable objects/functions in the evaluation context, this can enable unauthorized reads or modifications of application data and may lead to remote code execution. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates high confidentiality and integrity impact, with no user interaction required and network-reachable exploitation where the attacker has the necessary access to issue PATCH requests.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by disabling or restricting JSON Patch support (application/json-patch+json) on affected Spring Data REST item resources, especially for entities exposing Map-typed persistent properties. Limit who can issue PATCH requests through authentication and authorization controls, and where feasible disable or avoid exposing vulnerable item resources by default. Review domain models for exposed Map-typed properties reachable through REST patch paths and remove or shield them until fixed releases can be deployed.

Remediation

Patch, then assume compromise.

Upgrade Spring Data REST to a fixed release. Reported fixed versions are 3.7.20 for the 3.7.x line, 4.3.17 for 4.3.x, 4.4.15 for 4.4.x, 4.5.12 for 4.5.x, and 5.0.6 for 5.0.x. If running unsupported versions, migrate to a supported fixed release. Validate that all deployed Spring Data REST instances and transitive dependencies are updated and retest JSON Patch functionality after upgrade.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

BroadcomSpring Data Restapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

security online infoNews

Jun 11, 2026

Spring Data Vulnerabilities: Patch 5 Critical Flaws Now

A SpEL expression injection vulnerability in Spring Data that can be exploited via map-typed properties during JSON Patch processing, potentially leading to remote code execution.

cvefeed high severityNews

Jun 10, 2026

CVE-2026-41729 - Spring Data REST SpEL Injection via Map Key in JSON Patch

A SpEL expression injection vulnerability in Spring Data REST triggered via JSON Patch requests involving map-typed properties.

springNews

Jun 9, 2026

CVE-2026-41729: Spring Data REST SpEL Injection via Map Key in JSON Patch

A high-severity SpEL injection vulnerability in Spring Data REST where unsanitized JSON Patch map-key path segments are embedded into SpEL expressions, allowing arbitrary SpEL sub-expression evaluation in the context of the aggregate root.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-41729

NVD

nvd.nist.gov/vuln/detail/CVE-2026-41729

MITRE CWE · CWE-917

Improper Neutralization of Special Elements…

spring.io

spring.io/security/cve-2026-41729