4.3Media
CVE-2026-47850Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Descripción
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
Debilidad (CWE):
CWE-915
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Spring | Spring Data REST | 5.1.0, 5.0.0 – ≤ 5.0.6, 4.5.0 – ≤ 4.5.12, 4.0.0 – ≤ 4.4.15, ≤ 3.7.20 | |
| vmware | spring data rest | < 3.7.21 |
Referencias y parches
- https://spring.io/security/cve-2026-47850 Vendor Advisory
Coincidencias CPE (NVD) (5)
cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*< 3.7.21cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.4.16cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.13cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.6.1cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*≥ 5.1.0 < 5.1.0.1