CVE-2026-41007

HighCVSS 7.5

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: 1.5.0–1.5.6, 2.3.0–2.3.4, 2.4.0–2.4.1, 2.5.0–2.5.2, and 3.0.0–3.0.3.

Risk Assessment

An attacker could exhaust the cache, leading to resource exhaustion (DoS) or potentially information leakage through key manipulation.

Recommendation

Upgrade Spring HATEOAS to version 3.0.4 or later (or the appropriate patch for older branches) and consider limiting cache size.

Other vulnerabilities in Spring HATEOAS

CVE-2026-41006High
Spring HATEOAS's PropertyUtils.createObjectFromProperties method, used by Collection+JSON and UBER deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, 3.0.0-3.0.3.

Original NVD description (English source)

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.