CVE-2026-47850
published 2026-08-27CVE-2026-47850: Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.31%
22.3th percentile
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.
Spring Data REST 5.1.0
Spring Data REST 5.0.0 - 5.0.6
Spring Data REST 4.5.0 - 4.5.12
Spring Data REST 4.0.0 - 4.4.15
Spring Data REST 3.7.20 and earlier
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_data_rest | <= 3.7.20 | — |
| spring | spring_data_rest | — | — |
| spring | spring_data_rest | 4.0.0 – 4.4.15 | — |
| spring | spring_data_rest | 4.5.0 – 4.5.12 | — |
| spring | spring_data_rest | 5.0.0 – 5.0.6 | — |
| vmware | spring_data_rest | < 3.7.21 | 3.7.21 |
| vmware | spring_data_rest | >= 4.0.0 < 4.4.16 | 4.4.16 |
| vmware | spring_data_rest | >= 4.5.0 < 4.5.13 | 4.5.13 |
| vmware | spring_data_rest | >= 5.0.0 < 5.0.6.1 | 5.0.6.1 |
| vmware | spring_data_rest | >= 5.1.0 < 5.1.0.1 | 5.1.0.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Spring Data REST up to 5.1.0 dynamically-determined object attributes
vuldb·2026-08-27·CVSS 4.3
CVE-2026-47850 [MEDIUM] Spring Data REST up to 5.1.0 dynamically-determined object attributes
A vulnerability described as problematic has been identified in Spring Data REST up to 3.7.20/4.4.15/4.5.12/5.0.6/5.1.0. Affected by this vulnerability is an unknown functionality. Such manipulation leads to dynamically-determined object attributes.
This vulnerability is traded as CVE-2026-47850. The attack may be launched remotely. There is no exploit available.
GHSA
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.
ghsa_unreviewed·2026-08-27
CVE-2026-47850 [MEDIUM] CWE-915 Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.
Spring Data REST 5.1.0
Spring Data REST 5.0.0 - 5.0.6
Spring Data REST 4.5.0 - 4.5.12
Spring Data REST 4.0.0 - 4.4.15
Spring Data REST 3.7.20 and earlier
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-27
Published