Spring Security Advisories

RSS feed

Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

MEDIUM | JUNE 09, 2026 | CVE-2026-41837

Description

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.

Affected Spring Products and Versions

Spring Data REST:

  • 5.0.0 - 5.0.5
  • 4.5.0 - 4.5.11
  • 4.4.0 - 4.4.14
  • 4.3.0 - 4.3.16
  • 3.7.19 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
5.0.6OSS
5.0.5.1Enterprise Support Only
4.5.12OSS
4.5.11.1Enterprise Support Only
4.4.15Enterprise Support Only
4.3.17Enterprise Support Only
3.7.20Enterprise Support Only

Until upgrading, applications can mitigate the issue by implementing QuerydslBinderCustomizer on each affected repository and calling bindings.excludeUnlistedProperties(true) together with an explicit allow-list of filterable property paths.

References

History

  • 2026-06-09: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all