Spring Data 2025.1.6 and 2025.0.12 released

On behalf of the team and everyone who has contributed, I'm pleased to announce the availability of 2025.1.5 and 2025.0.11 service releases. These releases ship with dependency upgrades, fixes for regressions, and selected improvements.

CVEs fixed in this release

This release fixes the following CVEs:

• CVE-2026-41695: Denial of Service in Spring Data Commons Property Path Resolution
• CVE-2026-41696: Spring Data MongoDB Bind Parameter Literal Quoting Breakout
• CVE-2026-41697: Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
• CVE-2026-41711: Potential Denial of Service through crafted Sort Parameters
• CVE-2026-41716: Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names
• CVE-2026-41717: Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
• CVE-2026-41719: Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
• CVE-2026-41721: Spring Data Commons - Denial of Service via Data Binding
• CVE-2026-41728: Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
• CVE-2026-41729: Spring Data REST SpEL Injection via Map Key in JSON Patch
• CVE-2026-41730: Spring Data REST exposes persistence-layer internals in error responses
• CVE-2026-41837: Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

The upcoming Spring Boot releases will pick up the above releases by next week.

2025.1.6

• Spring Data Commons 4.0.6 - Javadoc - Documentation - Changelog
• Spring Data JPA 4.0.6 - Javadoc - Documentation - Changelog
• Spring Data MongoDB 5.0.6 - Javadoc - Documentation - Changelog
• Spring Data for Apache Cassandra 5.0.6 - Javadoc - Documentation - Changelog
• Spring Data KeyValue 4.0.6 - Javadoc - Documentation - Changelog
• Spring Data Neo4j 8.0.6 - Javadoc - Documentation - Changelog
• Spring Data LDAP 4.0.6 - Javadoc - Documentation - Changelog
• Spring Data REST 5.0.6 - Javadoc - Documentation - Changelog
• Spring Data Redis 4.0.6 - Javadoc - Documentation - Changelog
• Spring Data Elasticsearch 6.0.6 - Javadoc - Documentation - Changelog
• Spring Data Couchbase 6.0.6 - Javadoc - Documentation - Changelog
• Spring Data Relational 4.0.6 - Javadoc - Documentation - Changelog

2025.0.12

• Spring Data Commons 3.5.12 - Javadoc - Documentation - Changelog
• Spring Data JPA 3.5.12 - Javadoc - Documentation - Changelog
• Spring Data MongoDB 4.5.12 - Javadoc - Documentation - Changelog
• Spring Data for Apache Cassandra 4.5.12 - Javadoc - Documentation - Changelog
• Spring Data KeyValue 3.5.12 - Javadoc - Documentation - Changelog
• Spring Data Neo4j 7.5.12 - Javadoc - Documentation - Changelog
• Spring Data LDAP 3.5.12 - Javadoc - Documentation - Changelog
• Spring Data REST 4.5.12 - Javadoc - Documentation - Changelog
• Spring Data Redis 3.5.12 - Javadoc - Documentation - Changelog
• Spring Data Elasticsearch 5.5.12 - Javadoc - Documentation - Changelog
• Spring Data Couchbase 5.5.12 - Javadoc - Documentation - Changelog
• Spring Data Relational 3.5.12 - Javadoc - Documentation - Changelog

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe