CVE-2026-41729: Spring Data REST SpEL Injection in JSON Patch Requests

Technical summary

CVE-2026-41729 is a SpEL expression injection vulnerability in Spring Data REST's JSON Patch handler. When processing PATCH requests with Content-Type application/json-patch+json, the framework constructs SpEL expressions to update Map-typed entity properties. The JSON Pointer path segment that identifies the map key is concatenated directly into the SpEL expression without escaping or validation. An attacker with valid authentication can embed SpEL payloads in the path segment to achieve remote code execution. The vulnerability stems from improper trust of user-controlled input in a security-sensitive context (expression language evaluation).

Business impact

Successful exploitation grants an authenticated attacker code execution capabilities within the Spring application's process and security context. This enables data theft, lateral movement within internal systems, denial of service through resource exhaustion, and potential compromise of connected databases or microservices. Organizations using Spring Data REST to expose REST endpoints should assume all authenticated user sessions represent a potential attack vector. If those endpoints handle sensitive data or interconnect critical systems, this vulnerability creates a direct path to those assets.

Affected systems

VMware Spring Data REST versions 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5 are vulnerable. The vulnerability only manifests when: (1) JSON Patch requests are accepted (application/json-patch+json content type), and (2) the persistent entity exposes at least one Map-typed property. Applications using Spring Data REST without Map properties, or those that do not expose JSON Patch endpoints, are not affected. Confirm your dependency tree and entity definitions to determine exposure.

Exploitability

The vulnerability requires authentication, which limits the immediate attack surface to valid users or compromised credentials. However, the barrier to exploitation once authenticated is low: a single crafted JSON Patch request with a malicious SpEL expression in the map key is sufficient. No user interaction is required, and no special network positioning is needed—the attacker simply needs network access to the REST endpoint. The attack is deterministic and reliable if the vulnerable code path is reached. This is not listed on the CISA Known Exploited Vulnerabilities catalog as of the last update, but the straightforward nature of the attack suggests rapid weaponization is likely once public details emerge.

Remediation

Upgrade to patched versions of Spring Data REST that sanitize or reject SpEL-like patterns in JSON Patch path segments. Verify against the vendor advisory for the specific patch version for your branch. Additionally, implement input validation at the application level to reject JSON Patch requests containing suspicious characters or patterns in path segments. Consider disabling JSON Patch support entirely if it is not required by your use case. Restrict REST endpoint access via network controls and require strong authentication (multi-factor authentication where feasible) to reduce the likelihood of credential compromise.

Patch guidance

Check the VMware Spring Data REST security advisory for available patches within your supported version branch. Patches are expected for versions 3.7.x, 4.3.x, 4.4.x, 4.5.x, and 5.0.x. Apply patches according to your software release cycle, prioritizing production systems. Coordinate with development teams to validate that patched versions do not introduce breaking changes to your application's REST API consumers. Test JSON Patch functionality after patching to confirm remediation.

Detection guidance

Monitor HTTP PATCH requests to Spring Data REST endpoints with Content-Type application/json-patch+json. Look for JSON Pointer paths that contain SpEL operators or expressions (e.g., T(java.), #, ${}, parentheses, or backticks in the path segment). Implement Web Application Firewall (WAF) rules to block requests matching these patterns. Analyze application logs for exceptions related to SpEL expression evaluation or parsing errors in the JSON Patch handler. A sudden spike in PATCH request errors may indicate active exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention due to its CVSS score of 8.1 (HIGH severity) and the combination of authenticated remote code execution with low exploitation complexity. Although authentication is required, the impact spans confidentiality, integrity, and system availability. Code execution in the application process can compromise downstream systems and data. Organizations should treat this as a priority patch across all affected Spring Data REST deployments, particularly those handling sensitive transactions or data.

Risk score, explained

The CVSS v3.1 score of 8.1 reflects: Network accessibility (AV:N), low attack complexity (AC:L), and requirement for low-level privileges (PR:L). The vulnerability achieves high impact on confidentiality (C:H) and integrity (I:I) with no direct availability impact (A:N), consistent with code execution that does not inherently crash the service. The authentication requirement (PR:L) prevents a score in the Critical range but does not diminish the severity of the threat to authenticated users and system integrity.

Frequently asked questions