Spring Data REST serializes the full exception cause chain into HTTP error response bodies, which can reveal internal persistence-layer details to HTTP clients. This flaw allows an attacker to gain visibility into database types, table names, and other internal objects, compromising confidentiality as described by CWE-209.

The vulnerability affects Spring Data REST provided by Spring. Specifically, versions 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5 are affected. Users should verify their deployed version against these ranges.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. An attacker likely exploits this by sending requests that trigger exceptions—such as malformed input or unauthorized access—and then capturing the detailed error response. The impact remains limited to informational disclosure and does not enable further code execution or privilege escalation, but the exposed internal details can aid in subsequent attacks.