{"id":"CVE-2026-47850","title":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - …","summary":"Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-915"],"vendor":"vmware","product":"spring_data_rest","affected":["spring_data_rest < 3.7.21","spring_data_rest >= 4.0.0, < 4.4.16","spring_data_rest >= 4.5.0, < 4.5.13","spring_data_rest >= 5.0.0, < 5.0.6.1","spring_data_rest >= 5.1.0, < 5.1.0.1"],"patched":["spring_data_rest 5.1.0.1"],"published":"2026-08-27","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47850","references":[{"url":"https://spring.io/security/cve-2026-47850","label":"security@vmware.com"}],"tags":["nvd"],"epss":0.00183,"epssPercentile":0.08143,"ingestedAt":"2026-09-05T19:43:55.857Z","slug":"CVE-2026-47850","body":"## Overview\n\nSpring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.\nSpring Data REST 5.1.0\nSpring Data REST 5.0.0 - 5.0.6\nSpring Data REST 4.5.0 - 4.5.12\nSpring Data REST 4.0.0 - 4.4.15\nSpring Data REST 3.7.20 and earlier\n\n## Affected\n\n- `spring_data_rest < 3.7.21`\n- `spring_data_rest >= 4.0.0, < 4.4.16`\n- `spring_data_rest >= 4.5.0, < 4.5.13`\n- `spring_data_rest >= 5.0.0, < 5.0.6.1`\n- `spring_data_rest >= 5.1.0, < 5.1.0.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spring_data_rest 5.1.0.1`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}