Vulnerability Directory | CVE-2026-41837

Overview

Spring Data REST is a Spring Data module that automatically exposes repositories as hypermedia-driven REST resources, including optional Querydsl-backed filtering of collection resources through request parameters. When a repository implements QuerydslPredicateExecutor, Spring Data REST turns query-string parameters into Querydsl predicates so clients can filter results, for example GET /users?lastname=Smith.

A medium-severity vulnerability (CVE-2026-41837) has been identified in Spring Data REST. Querydsl's default bindings permit filtering on every persistent property of the domain type, and the framework derives which fields are public from Jackson annotations on that type. The affected code accepts arbitrary persistent property paths as filter keys and hands the raw request-parameter map to Querydsl without first consulting those Jackson customizations. A persistent field that the application has hidden from its JSON representation with @JsonIgnore therefore remains usable as a server-side filter key, and a field renamed with @JsonProperty is not addressable under its public alias. An unauthenticated remote attacker can filter on a hidden field and observe whether matching records exist, turning a field whose value is never serialized into a confidentiality oracle.

Per OWASP, sensitive information disclosure occurs when an application allows data to be accessed by an actor that is not explicitly authorized to have access, leaking it through unintended channels even when it is never displayed directly. This issue is that pattern applied to filtering: a field excluded from responses is still queryable, so its presence can be inferred from filtered result sets.

This issue affects >=3.5.0 <=3.5.12, >=3.7.0 <=3.7.19, >=4.2.0 <=4.2.12, >=4.3.0 <=4.3.16, >=4.4.0 <=4.4.14, >=4.5.0 <=4.5.11, and >=5.0.0 <=5.0.5 of Spring Data REST. Versions that are no longer supported are also affected.

‍

Details

Module Info

Product: Spring Data REST
Affected packages: spring-data-rest-webmvc, spring-data-rest-core
Affected versions: >=3.5.0 <=3.5.12, >=3.7.0 <=3.7.19, >=4.2.0 <=4.2.12, >=4.3.0 <=4.3.16, >=4.4.0 <=4.4.14, >=4.5.0 <=4.5.11, >=5.0.0 <=5.0.5
GitHub repository: https://github.com/spring-projects/spring-data-rest
Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-rest-core
Package manager: Maven
Fixed in:
NES for Spring Data REST 3.5.x, 3.7.x, 4.2.x, 4.3.x, 4.4.x
Spring Data REST 5.0.6, 4.5.12 (OSS)

Vulnerability Info

When a repository is exposed with Querydsl support, Spring Data REST resolves the request-parameter map into a Querydsl Predicate in QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver. The affected code forwards the parameter map straight to the predicate builder, so every persistent property path is accepted as a filter key regardless of how the domain type is exposed through Jackson:

private Optional<Pair<QuerydslPredicateExecutor<?>, Predicate>> getRepositoryAndPredicate(
        QuerydslPredicateExecutor<?> repository, Class<?> domainType, Map<String, String[]> parameters) {

    TypeInformation<?> type = TypeInformation.of(domainType);

    QuerydslBindings bindings = factory.createBindingsFor(type);
    Predicate predicate = predicateBuilder.getPredicate(type, toMultiValueMap(parameters), bindings);

    return Optional.ofNullable(predicate).map(it -> Pair.of(repository, it));
}

‍‍Querydsl's default bindings are permit-all: any persistent property is a valid filter key. Because the parameters map is passed through untouched, a request keyed on a field annotated with @JsonIgnore, such as a hidden ssn field, is still translated into a predicate and applied to the query. The matching records are filtered server-side even though the field is never serialized back to the client, so the size and contents of the filtered response disclose whether records with a given hidden-field value exist. Likewise, a field renamed for serialization with @JsonProperty("renamed") cannot be filtered under its public alias because the resolver works only on the raw persistent property name.

This vulnerability has been present since at least Spring Data REST 3.5 and likely earlier.

‍

Mitigation

Spring Data REST 3.5.x, 3.7.x, 4.2.x, 4.3.x, and 4.4.x are End-of-Life in open source and will not receive further OSS security updates; see https://spring.io/projects/spring-data-rest for the support timeline. HeroDevs does not recommend that users attempt to develop and apply their own source patches to End-of-Life software.

The recommended actions are:

Upgrade to a supported, fixed release. The issue is fixed in OSS in Spring Data REST 4.5.12 and 5.0.6.
For End-of-Life lines that cannot be upgraded, HeroDevs Never-Ending Support (NES) for Spring Data REST provides a drop-in replacement that backports this fix while remaining compatible with the affected versions. Learn more about HeroDevs Never-Ending Support for Spring Data REST and request coverage at https://www.herodevs.com/support/spring-nes.

As an interim measure, applications can implement QuerydslBinderCustomizer on each affected repository and call bindings.excludeUnlistedProperties(true) together with an explicit allow-list of filterable property paths.

‍