---
id: CVE-2026-47850
title: >-
  Spring Data REST does not preserve the persisted version (@Version) property
  of an aggregate root when handling an HTTP PUT against an immutable target
  type.

  Spring Data REST 5.1.0

  Spring Data REST 5.0.0 - 5.0.6

  Spring Data REST 4.5.0 - …
summary: >-
  Spring Data REST does not preserve the persisted version (@Version) property
  of an aggregate root when handling an HTTP PUT against an immutable target
  type.

  Spring Data REST 5.1.0

  Spring Data REST 5.0.0 - 5.0.6

  Spring Data REST 4.5.0 - …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-915
vendor: vmware
product: spring_data_rest
affected:
  - spring_data_rest < 3.7.21
  - 'spring_data_rest >= 4.0.0, < 4.4.16'
  - 'spring_data_rest >= 4.5.0, < 4.5.13'
  - 'spring_data_rest >= 5.0.0, < 5.0.6.1'
  - 'spring_data_rest >= 5.1.0, < 5.1.0.1'
patched:
  - spring_data_rest 5.1.0.1
published: '2026-08-27'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47850'
references:
  - url: 'https://spring.io/security/cve-2026-47850'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00306
epssPercentile: 0.20848
ingestedAt: '2026-09-05T19:43:55.857Z'
---

## Overview

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type.
Spring Data REST 5.1.0
Spring Data REST 5.0.0 - 5.0.6
Spring Data REST 4.5.0 - 4.5.12
Spring Data REST 4.0.0 - 4.4.15
Spring Data REST 3.7.20 and earlier

## Affected

- `spring_data_rest < 3.7.21`
- `spring_data_rest >= 4.0.0, < 4.4.16`
- `spring_data_rest >= 4.5.0, < 4.5.13`
- `spring_data_rest >= 5.0.0, < 5.0.6.1`
- `spring_data_rest >= 5.1.0, < 5.1.0.1`

## Remediation

Upgrade past the affected range:

- `spring_data_rest 5.1.0.1`