AIKIDO-2026-11172
spring-data-rest-core is vulnerable to Generation of Error Message Containing Sensitive Information
53
Medium Risk
This Affects:
spring-data-rest-coreTL;DR
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-data-rest-core is vulnerable to Generation of Error Message Containing Sensitive Information in versions 0.0.1 - 3.7.19, 4.0.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11 and 5.0.0 - 5.0.5.
How to fix this
Upgrade the org.springframework.data:spring-data-rest-core library to the patch version. Affected applications are those that expose a Spring Data REST repository backed by a relational (JDBC/JPA) store and do not apply additional error-handling configuration or a Spring Security access policy that prevents unauthenticated access to the affected endpoints.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant