CVE-2026-41007
published 2026-06-09CVE-2026-41007: Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.30%
22.4th percentile
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_hateoas | >= 1.5.0 < 1.5.7 | 1.5.7 |
| spring | spring_hateoas | >= 2.3.0 < 2.3.5 | 2.3.5 |
| spring | spring_hateoas | >= 2.4.0 < 2.4.2 | 2.4.2 |
| spring | spring_hateoas | >= 2.5.0 < 2.5.2.1 | 2.5.2.1 |
| spring | spring_hateoas | >= 3.0.0 < 3.0.3.1 | 3.0.3.1 |
| vmware | spring_hateoas | >= 1.5.0 < 1.5.7 | 1.5.7 |
| vmware | spring_hateoas | >= 2.3.0 < 2.3.5 | 2.3.5 |
| vmware | spring_hateoas | >= 2.4.0 < 2.4.2 | 2.4.2 |
| vmware | spring_hateoas | >= 2.5.0 < 2.5.2.1 | 2.5.2.1 |
| vmware | spring_hateoas | >= 3.0.0 < 3.0.3.1 | 3.0.3.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
spring-hateoas: Spring HATEOAS: Denial of Service via unbounded static cache
vendor_redhat·2026-06-09·CVSS 7.5
CVE-2026-41007 [HIGH] CWE-770 spring-hateoas: Spring HATEOAS: Denial of Service via unbounded static cache
spring-hateoas: Spring HATEOAS: Denial of Service via unbounded static cache
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
A flaw was found in Spring HATEOAS. An attacker can exploit this vulnerability by supplying specially crafted strings, which are then used as keys in an unbounded static cache. This can lead to resource exhaustion, causing a denial of service (DoS) for the application.
Statement: This is an Important denial of service flaw in Spring HATEOAS, affecting Red Hat JBoss Fuse. The vulnerability arises from an unbounded static cache that can be exhausted by attacke
GHSA
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
ghsa_unreviewed·2026-06-09
CVE-2026-41007 [HIGH] CWE-770 Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
GHSA
Spring HATEOAS heap exhaustion through unbounded internal caching
ghsa·2026-06-09
CVE-2026-41007 [HIGH] CWE-770 Spring HATEOAS heap exhaustion through unbounded internal caching
Spring HATEOAS heap exhaustion through unbounded internal caching
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
No detection rules found.
No public exploits indexed.
2026-06-09
Published