Vulnerability Directory | CVE-2026-41730

Overview

Spring Data REST is a Spring Data module that automatically exports JPA, JDBC, MongoDB, and other Spring Data repositories as hypermedia-driven REST endpoints, turning repository methods into HTTP resources without hand-written controllers. When a request against one of those endpoints fails, Spring Data REST returns a JSON error body describing the failure so clients can react to it.

A medium-severity vulnerability (CVE-2026-41730) has been identified in Spring Data REST. The framework serializes the full exception cause chain into the HTTP error response body. The internal ExceptionMessage helper exposes a cause property that recursively wraps every nested Throwable, so the JSON returned to the client contains not just the top-level error message but each underlying cause in turn. For a repository backed by a relational (JDBC or JPA) store, the leaf causes of a failure are persistence-layer exceptions whose messages commonly embed SQL statement text, column and constraint names, driver error strings, and submitted values. An application that exposes such a repository through Spring Data REST without an additional error-handling configuration or a Spring Security access policy in front of the affected endpoints therefore leaks database internals to any client that can trigger a failing request, aiding reconnaissance of the schema and data model.

Per OWASP, improper error handling can disclose implementation details, such as stack traces, database dumps, and error codes, that are useful to an attacker because they reveal additional information that may otherwise be hidden, increasing the attacker's ability to compromise the system.

This issue affects >=3.5.0 <=3.5.12, >=3.7.0 <=3.7.19, >=4.2.0 <=4.2.12, >=4.3.0 <=4.3.16, >=4.4.0 <=4.4.14, >=4.5.0 <=4.5.11, and >=5.0.0 <=5.0.5 of Spring Data REST.

‍

Details

Module Info

Product: Spring Data REST
Affected packages: spring-data-rest-webmvc
Affected versions: >=3.5.0 <=3.5.12, >=3.7.0 <=3.7.19, >=4.2.0 <=4.2.12, >=4.3.0 <=4.3.16, >=4.4.0 <=4.4.14, >=4.5.0 <=4.5.11, >=5.0.0 <=5.0.5
GitHub repository: https://github.com/spring-projects/spring-data-rest
Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-rest-webmvc
Package manager: Maven
Fixed in:
NES for Spring Data REST 3.5.x, 3.7.x, 4.2.x, 4.3.x, 4.4.x
Spring Data REST 5.0.6, 4.5.12 (OSS)

Vulnerability Info

Spring Data REST renders exceptions into JSON through the ExceptionMessage helper, which is constructed from the thrown Throwable and exposes two serialized properties: the message and the cause.

public class ExceptionMessage {

    private final Throwable throwable;

    public ExceptionMessage(Throwable throwable) {
        this.throwable = throwable;
    }

    @JsonProperty("message")
    public String getMessage() {
        return throwable.getMessage();
    }

    @JsonProperty("cause")
    public ExceptionMessage getCause() {
        return throwable.getCause() != null
            ? new ExceptionMessage(throwable.getCause())
            : null;
    }
}

Because getCause() is annotated @JsonProperty("cause") and recursively wraps each nested Throwable in another ExceptionMessage, Jackson walks and serializes the entire cause chain into the response body. The exception handlers that most often carry persistence internals, including those for DataIntegrityViolationException, OptimisticLockingFailureException, and ConversionFailedException, pass the raw exception straight into this helper. When the repository is backed by a relational store, the nested causes are JDBC or JPA exceptions whose messages contain SQL fragments, constraint and column names, and the offending values, all of which are then echoed verbatim to the HTTP client.

Exploitation requires no special tooling: any request that provokes a server-side failure, such as a write that violates a database constraint or a value that fails type conversion, returns the populated cause chain. If the affected endpoints are reachable without authentication, an unauthenticated remote client can probe them to map the schema and data model.

This vulnerability has been present since the earliest Spring Data REST releases (2013).

‍

Mitigation

Spring Data REST versions 4.5.x and 5.0.x receive the fix in the open-source releases 4.5.12 and 5.0.6; versions 3.7.x, 4.3.x, and 4.4.x are past their open-source support window and have no publicly available fix. Users still running an affected open-source line that no longer receives free updates should not attempt to hand-patch the exception-handling internals.

To remediate this issue, affected users have two recommended options:

Upgrade to a supported, fixed release of Spring Data REST.
Adopt HeroDevs Never-Ending Support (NES) for Spring Data REST, which provides a drop-in compatible build with this vulnerability fixed for release lines that are otherwise end-of-life, with no code changes required. Learn more about HeroDevs Never-Ending Support for Spring Data REST and request coverage at https://www.herodevs.com/support/spring-nes

‍