What is the CVSS score of EUVD-2026-35907?

EUVD-2026-35907 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-35907?

Yes, a patch is available for EUVD-2026-35907. Update the affected software to the latest version immediately.

Spring Data REST EUVD-2026-35907

| CVE-2026-41730 MEDIUM

Error Message Information Leak (CWE-209)

2026-06-10 security@vmware.com

GHSA-p5mm-xwgq-whfr

Information Disclosure Java Spring Data Rest

5.3

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:44 vuln.today

DescriptionCVE.org

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.

Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

AnalysisAI

Spring Data REST leaks persistence-layer internals - including database schema details, Hibernate/JPA exception messages, and query structures - by serializing the full exception cause chain directly into HTTP error response bodies. All five active release lines are affected (3.7.x, 4.3.x, 4.4.x, 4.5.x, and 5.0.x), and the CVSS vector confirms unauthenticated remote exploitation against default configurations with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the zero-friction access conditions make any network-exposed Spring Data REST deployment a realistic target for automated reconnaissance that could enable follow-on, more damaging attacks.

Technical ContextAI

Spring Data REST is a Spring Framework component (maintained by VMware/Broadcom) that automatically exposes JPA and Spring Data repositories as RESTful HTTP endpoints with minimal configuration. The vulnerability maps to CWE-209 (Generation of Error Message Containing Sensitive Information), a class where error-handling code inadvertently leaks internal state. When a persistence-layer exception - such as a Hibernate constraint violation, a JPA query error, or a JDBC exception - propagates through the request-handling stack, Spring Data REST's default error serializer writes the complete Java exception cause chain, including nested exception class names, messages, and potentially embedded SQL fragments or ORM-generated query text, into the HTTP response body returned to the client. No CPE strings were provided in the input data, but affected products are identified by vendor as Spring Data REST across five release lines. The reporter is security@vmware.com, confirming official vendor acknowledgment.

RemediationAI

The primary remediation is upgrading Spring Data REST to a fixed release; exact patched versions are not included in the provided input data and must be confirmed directly in the vendor advisory at https://spring.io/security/cve-2026-41730 before deploying a fix. As an interim compensating control, implement a custom Spring @ControllerAdvice or ResponseEntityExceptionHandler that intercepts persistence-layer exceptions and returns sanitized, generic error responses - stripping the cause chain before serialization; note this requires application code changes and regression testing of error-handling paths. Alternatively, deploy a WAF or API gateway configured to redact or normalize HTTP error response bodies, though this adds operational complexity and risks interfering with legitimate client error-handling logic. Restricting Spring Data REST endpoints to authenticated sessions or internal network segments reduces exposure by limiting who can trigger and observe the leak, but does not eliminate the underlying serialization flaw and should be treated as defense-in-depth rather than a standalone fix.