CVE-2026-41006

published 2026-06-09

CVE-2026-41006: Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean…

Priority P3 43 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
spring	spring_hateoas	>= 1.5.0 < 1.5.7	1.5.7
spring	spring_hateoas	>= 2.3.0 < 2.3.5	2.3.5
spring	spring_hateoas	>= 2.4.0 < 2.4.2	2.4.2
spring	spring_hateoas	>= 2.5.0 < 2.5.2.1	2.5.2.1
spring	spring_hateoas	>= 3.0.0 < 3.0.3.1	3.0.3.1
vmware	spring_hateoas	>= 1.5.0 < 1.5.7	1.5.7
vmware	spring_hateoas	>= 2.3.0 < 2.3.5	2.3.5
vmware	spring_hateoas	>= 2.4.0 < 2.4.2	2.4.2
vmware	spring_hateoas	>= 2.5.0 < 2.5.2.1	2.5.2.1
vmware	spring_hateoas	>= 3.0.0 < 3.0.3.1	3.0.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284