Overview
About vulnerability
SVG ImageDescription
Spring Data REST’s Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.
SVG ImageAffected Spring Products and Versions
Spring Data REST:
- 3.7.0 - 3.7.19
- 4.3.0 - 4.3.16
- 4.4.0 - 4.4.14
- 4.5.0 - 4.5.11
- 5.0.0 - 5.0.5
Versions that are no longer supported are also affected.
SVG ImageMitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 3.7.x | 3.7.20 | Commercial |
| 4.3.x | 4.3.17 | Commercial |
| 4.4.x | 4.4.15 | Commercial |
| 4.5.x | 4.5.12 | OSS |
| 5.0.x | 5.0.6 | OSS |
Until upgrading, applications can mitigate the issue by implementing QuerydslBinderCustomizer on each affected repository and calling bindings.excludeUnlistedProperties(true) together with an explicit allow-list of filterable property paths.
SVG ImageReferences
SVG ImageHistory
- 2026-06-09: Initial vulnerability report published.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Boot @ 2.7.18 (+77 more)
SVG ImageDescription
Spring Data REST’s Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.
SVG ImageAffected Spring Products and Versions
Spring Data REST:
- 3.7.0 - 3.7.19
- 4.3.0 - 4.3.16
- 4.4.0 - 4.4.14
- 4.5.0 - 4.5.11
- 5.0.0 - 5.0.5
Versions that are no longer supported are also affected.
SVG ImageMitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 3.7.x | 3.7.20 | Commercial |
| 4.3.x | 4.3.17 | Commercial |
| 4.4.x | 4.4.15 | Commercial |
| 4.5.x | 4.5.12 | OSS |
| 5.0.x | 5.0.6 | OSS |
Until upgrading, applications can mitigate the issue by implementing QuerydslBinderCustomizer on each affected repository and calling bindings.excludeUnlistedProperties(true) together with an explicit allow-list of filterable property paths.
SVG ImageReferences
SVG ImageHistory
- 2026-06-09: Initial vulnerability report published.