Spring Data REST and Spring AI Vulnerabilities: Four High-Severity Flaws Patched
Do Son 
TL;DR
VMware disclosed four Spring vulnerabilities on August 20, 2026. All rate as HIGH severity. One hits Spring Data REST, and three affect Spring AI. Impacts range from horizontal privilege escalation to denial of service. No exploitation in the wild or public proof-of-concept has been confirmed.
Why These Spring Vulnerabilities Matter
Spring frameworks run countless Java applications and AI pipelines. As a result, one flaw can affect many systems. This batch mixes data-layer and AI-layer risks. The data flaw can expose records across users. The AI flaws threaten availability and model integrity. The official advisories live on the Spring Security page.
How the Attacks Work
CVE-2026-47849: JSON Patch Property Mutation
Spring Data REST skips identifier and version fields during PUT and merge-patch binding. However, the JSON Patch path applies no such guard. Therefore an authenticated client with PATCH access can overwrite those fields. Overwriting the version defeats optimistic locking. Overwriting the identifier can let a save clobber another user’s record. That is horizontal privilege escalation.
CVE-2026-59279: MCP Session Exhaustion
The Spring AI MCP streamable HTTP transport keeps sessions without limit. By default, it also skips authentication. So a remote attacker can pile up sessions until memory runs out. The result is a denial of service for all clients.
CVE-2026-47851 and CVE-2026-47852: PDF and Model Risks
The PDF reader can hit a StackOverflowError on a deeply nested or cyclic outline. A crafted PDF thus crashes the ingestion thread. Separately, a predictable cache path lets a local user plant a malicious ONNX model. On a shared host, that swap can subvert model integrity.
Affected Versions
Spring Data REST versions through 5.1.0 are affected, depending on the branch. The Spring AI flaws mainly target the 1.x line and 2.0.0. The MCP session flaw affects Spring AI 2.0.0 only.
Patch and Mitigation Steps
Upgrade first. Spring Data REST 5.1.1 and 5.0.7 are the OSS fixes. Spring AI 2.0.1 fixes the MCP session flaw in OSS. For the JSON Patch issue, you can also mark identifier and version fields with @JsonIgnore. Require authentication on MCP endpoints as an added control.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
