How many spring-projects spring-data-rest CVEs are in CISA KEV?

None of spring-projects spring-data-rest's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of spring-projects spring-data-rest are affected?

50 distinct spring-projects spring-data-rest versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in spring-projects spring-data-rest CVEs?

spring-projects spring-data-rest's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')).

What is the average severity of spring-projects spring-data-rest CVEs?

The average CVSS base score across spring-projects spring-data-rest's scored CVEs is 5.9.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

spring-projects

6 CVEs

spring-projects spring-data-rest Vulnerabilities

Name: spring-projects spring-data-rest vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for spring-data-rest by spring-projects.

6

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

5.9

Avg CVSS

2021–2026

Last updated June 9, 2026

Overview

spring-projects spring-data-rest has 6 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 5.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting spring-projects spring-data-rest, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of spring-projects spring-data-rest's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High2

Medium3

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of spring-projects spring-data-rest's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No spring-projects spring-data-rest CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every spring-projects spring-data-rest version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

4.5.04 CVEs
4.5.14 CVEs
4.5.104 CVEs
4.5.114 CVEs
4.5.24 CVEs
4.5.34 CVEs
4.5.44 CVEs
4.5.54 CVEs
4.5.64 CVEs
4.5.74 CVEs
4.5.84 CVEs
4.5.94 CVEs
5.0.04 CVEs
5.0.14 CVEs
5.0.24 CVEs
5.0.34 CVEs
5.0.44 CVEs
5.0.54 CVEs
3.4.01 CVE
3.4.11 CVE
3.4.101 CVE
3.4.111 CVE
3.4.121 CVE
3.4.131 CVE
3.4.21 CVE
3.4.31 CVE
3.4.41 CVE
3.4.51 CVE
3.4.61 CVE
3.4.71 CVE
3.4.81 CVE
3.4.91 CVE
3.5.01 CVE
3.5.11 CVE
3.5.21 CVE
3.5.31 CVE
3.5.41 CVE
3.5.51 CVE
3.6.01 CVE
3.6.11 CVE
3.6.21 CVE
3.6.31 CVE
3.6.41 CVE
3.6.51 CVE
3.6.61 CVE
3.7.01 CVE
3.7.11 CVE
3.7.21 CVE

Fixed in

5cb03bfcf0f610e439ce99fa3a6fc8686a98bb481 CVE
984e1ffc005f2eb6fe2c743ecbeaeb77979b724e1 CVE

Find a version

6 CVEs

Sort

Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
CVE-2026-41837
Patch
CWE-284
Medium · CVSS 5.3
EPSS 0.2% (9th pct)2026-06-09
Spring Data REST exposes persistence-layer internals in error responses
CVE-2026-41730
Patch
CWE-209
Medium · CVSS 5.3
EPSS 0.2% (10th pct)2026-06-09
Spring Data REST SpEL Injection via Map Key in JSON Patch
CVE-2026-41729
Patch
CWE-917
High · CVSS 8.1
EPSS 0.4% (32th pct)2026-06-09
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
CVE-2026-41728
Patch
CWE-284
High · CVSS 7.5
EPSS 0.3% (23th pct)2026-06-09
Low vulnerability · 2022-09-21
CVE-2022-31679
Patch
Low · CVSS 3.7
EPSS 0.5% (38th pct)2022-09-21
Medium vulnerability · 2021-10-28
CVE-2021-22047
Patch
CWE-200
Medium · CVSS 5.3
EPSS 0.7% (51th pct)2021-10-28

Common weakness types

The CWE weakness categories most often found in spring-projects spring-data-rest CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many spring-projects spring-data-rest CVEs were published each year.

2021

1

2022

1

2026

4

Other spring-projects products

Browse vulnerabilities for other products by spring-projects.

spring-framework37 CVEs spring-security31 CVEs spring-boot17 CVEs spring-ai16 CVEs spring-amqp7 CVEs spring-data-commons7 CVEs spring-security-oauth6 CVEs spring-graphql4 CVEs

All spring-projects vulnerabilities

Frequently asked questions

Common questions about spring-projects spring-data-rest vulnerabilities.

How many CVEs does spring-projects spring-data-rest have?: spring-projects spring-data-rest has 6 published CVE records since 2021.
How many spring-projects spring-data-rest CVEs are in CISA KEV?: None of spring-projects spring-data-rest's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for spring-projects spring-data-rest vulnerabilities?: No spring-projects spring-data-rest CVEs currently have a tracked public exploit in this dataset.
Which versions of spring-projects spring-data-rest are affected?: 50 distinct spring-projects spring-data-rest versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in spring-projects spring-data-rest CVEs?: spring-projects spring-data-rest's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')).
What is the average severity of spring-projects spring-data-rest CVEs?: The average CVSS base score across spring-projects spring-data-rest's scored CVEs is 5.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track spring-projects spring-data-rest vulnerabilities

Monitor new spring-projects spring-data-rest vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing