CVE-2026-41007

published 2026-06-09

CVE-2026-41007: Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0…

Priority P3 41 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
spring	spring_hateoas	>= 1.5.0 < 1.5.7	1.5.7
spring	spring_hateoas	>= 2.3.0 < 2.3.5	2.3.5
spring	spring_hateoas	>= 2.4.0 < 2.4.2	2.4.2
spring	spring_hateoas	>= 2.5.0 < 2.5.2.1	2.5.2.1
spring	spring_hateoas	>= 3.0.0 < 3.0.3.1	3.0.3.1
vmware	spring_hateoas	>= 1.5.0 < 1.5.7	1.5.7
vmware	spring_hateoas	>= 2.3.0 < 2.3.5	2.3.5
vmware	spring_hateoas	>= 2.4.0 < 2.4.2	2.4.2
vmware	spring_hateoas	>= 2.5.0 < 2.5.2.1	2.5.2.1
vmware	spring_hateoas	>= 3.0.0 < 3.0.3.1	3.0.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-770