cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version ( @Version ) property of an aggregate root when handling an HTTP PUT against an immutable target type. For mutable aggregates, the PUT merge logic explicitly retains the stored identifier and version properties, discarding any client-supplied values. For immutable aggregates — Java records, Kotlin data classes, all-args @PersistenceCreator types — or when a polymorphic ( @JsonTypeInfo ) subtype change occurs, the merge instead returns the request-body object and restores only Jackson @JsonIgnore -marked properties from storage. The vers…

Spring Security Advisoriesで読む

2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT」を公開しました (種別: 脆弱性アドバイザリ)。関連する技術: Spring、Java、Kotlin。CVE: CVE-2026-47850。