CVE-2026-41729

High

Advisory

Published 10 Jun 2026In the index since 8 Sept 2026

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
spring-data-rest-coremaven	3.5.1, 3.7.7	no fix listed	2

2 by stars

Chart

Latest

Affected images

Radar Score

komgageek-cookbook

1 of the 1 container images this version deploys carry CVE-2026-41729.

Container image	Digest	Package	Fixed in
gotson/komga :0.99.4	9b15ea6bfc30	spring-data-rest-core@3.5.1	no fix listed

12,581

1 of the 2 container images this version deploys carry CVE-2026-41729.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-server :0.1.17	b2de13916f3e	spring-data-rest-core@3.7.7	no fix listed

5,846

2 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
gotson/komga :0.99.4	9b15ea6bfc30	spring-data-rest-core@3.5.1	no fix listed	1
zahoriaut/zahori-server :0.1.17	b2de13916f3e	spring-data-rest-core@3.7.7	no fix listed	1