CVE-2026-41006

HighCVSS 7.5

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Spring HATEOAS's PropertyUtils.createObjectFromProperties method, used by Collection+JSON and UBER deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, 3.0.0-3.0.3.

Risk Assessment

The vulnerability could allow a remote attacker to manipulate bean objects, potentially leading to unauthorized access or code execution.

Recommendation

Update Spring HATEOAS to a patched version (e.g., 1.5.7, 2.3.5, 2.4.2, 2.5.3, 3.0.4 or later).

Other vulnerabilities in Spring HATEOAS

CVE-2026-41007High
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: 1.5.0–1.5.6, 2.3.0–2.3.4, 2.4.0–2.4.1, 2.5.0–2.5.2, and 3.0.0–3.0.3.

Original NVD description (English source)

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.