Spring Data Rest

Vendor:

First CVE: Jan 4, 2018 · Active for 8 years

10
Total CVEs
More Total CVEs than 88% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 74% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 41% of tracked products
10.0%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Spring Data Rest over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jan 4, 2018
8 years ago
Most Recent CVE
Jun 10, 2026
44 days ago

CVE Severity & Scoring

Spring Data Rest10 CVEs
All CVEs352,294 CVEs
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network10 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (90.0%)
High1 (10.0%)
Unknown0 (0.0%)
User Interaction
None10 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low1 (10.0%)
High0 (0.0%)
None9 (90.0%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (10 CVEs).

10 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2018-1273CRITICAL
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of s
Apr 11, 20189.898YESYES
CVE-2017-8046CRITICAL
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.
Jan 4, 20189.888NOYES
CVE-2026-41729HIGH
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity
Jun 10, 20268.133NONO
CVE-2026-41728HIGH
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON
Jun 10, 20267.533NONO
CVE-2018-1259HIGH
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability ca
May 11, 20187.528NONO
CVE-2018-1274HIGH
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. A
Apr 18, 20187.527NONO
CVE-2026-41837MEDIUM
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing the
Jun 10, 20265.325NONO
CVE-2026-41730MEDIUM
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Sp
Jun 10, 20265.323NONO
CVE-2021-22047MEDIUM
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a
Oct 28, 20215.319NONO
CVE-2022-31679LOW
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows ab
Sep 21, 20223.717NONO
View all 10 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (10 CVEs).

CISA KEV
1 CVE
10.0% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
2 CVEs
20.0% of CVEs· 98th percentile
ExploitDB
1 CVE
10.0% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (10 CVEs).

Media Mentions

Signals from CVEs in this product scope (10 CVEs).

Top CNAs Publishing CVEs For Spring Data Rest

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
3.0.019.874.4%01