CVE-2026-41837: Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

June 10, 2026 (updated August 12, 2026)

Spring Data REST’s Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

References

github.com/advisories/GHSA-mwpv-rg79-863c
nvd.nist.gov/vuln/detail/CVE-2026-41837
spring.io/security/cve-2026-41837

Code Behaviors & Features

Detect and mitigate CVE-2026-41837 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →