CVE-2026-47849 Spring CVE debrief

Who should care

Users and administrators of Spring Data REST instances should be aware of this vulnerability and take steps to address it. This includes applying patches or updates, verifying identifier and version properties are properly guarded, and monitoring for unauthorized JSON Patch requests.

Technical summary

CVE-2026-47849 is a vulnerability in Spring Data REST that allows for the mutation of identifier (@Id) and version (@Version) properties via RFC 6902 JSON Patch requests. This vulnerability affects multiple versions of Spring Data REST, including 3.7.20 and earlier, 4.0.0 - 4.4.15, 4.5.0 - 4.5.12, 5.0.0 - 5.0.6, and 5.1.0. To address this vulnerability, apply vendor patches or updates to Spring Data REST, verify identifier and version properties are properly guarded in Spring Data REST implementations, and monitor for and restrict unauthorized JSON Patch requests to affected Spring Data REST instances.

Defensive priority

Patch and verify identifier and version properties are properly guarded in Spring Data REST implementations.

Recommended defensive actions

• Apply vendor patches or updates to Spring Data REST to address the vulnerability.
• Verify identifier and version properties are properly guarded in Spring Data REST implementations.
• Monitor for and restrict unauthorized JSON Patch requests to affected Spring Data REST instances.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-47849 record indicates Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch requests. Affected versions include Spring Data REST 3.7.20 and earlier, 4.0.0 - 4.4.15, 4.5.0 - 4.5.12, 5.0.0 - 5.0.6, and 5.1.0. The vulnerability has a CVSS score of 7.1 and a severity of HIGH. Users and administrators of Spring Data REST instances should verify identifier and version properties are properly guarded and monitor for unauthorized JSON Patch requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.