CVE-2026-41006
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
CVE-2026-41006- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-35345
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
EUVD-2026-35345- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7fxc-486f-32q9
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
GHSA-7fxc-486f-32q9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
CVE-2026-41006- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
CVE-2026-41006- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-7fxc-486f-32q9
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
GHSA-7fxc-486f-32q9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1782954020 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 1.5.6-tuxcare.4.
- Record
CLSA-2026-1782954020- Updated
- 2026-11-02
OSVCLSA-2026-1786690945 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.4.1-tuxcare.2.
- Record
CLSA-2026-1786690945- Updated
- 2026-11-02
OSVCLSA-2026-1787147294 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.3.4-tuxcare.1.
- Record
CLSA-2026-1787147294- Updated
- 2026-11-02
OSVCLSA-2026-1787917768 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.0.7-tuxcare.1.
- Record
CLSA-2026-1787917768- Updated
- 2026-11-02
OSVCLSA-2026-1789455724 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.2.5-tuxcare.1.
- Record
CLSA-2026-1789455724- Updated
- 2026-11-02
OSVCLSA-2026-1792568406 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.1.3-tuxcare.1.
- Record
CLSA-2026-1792568406- Updated
- 2026-11-02
OSVCLSA-2026-1793714833 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 1.1.2.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793714833- Updated
- 2026-11-03
OSVROOT-APP-MAVEN-CVE-2026-41006 No score
CVE-2026-41006 in org.springframework.hateoas:spring-hateoas - Patched by Root
Root has patched CVE-2026-41006 in the org.springframework.hateoas:spring-hateoas package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41006- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.hateoas:spring-hateoasMaven |
3.0.0 to 3.0.3 | 3.0.4 |
org.springframework.hateoas:spring-hateoasMaven |
2.5.0 to 2.5.2 | 2.5.3 |
org.springframework.hateoas:spring-hateoasMaven |
2.3.0 to 2.3.4 | None known |
org.springframework.hateoas:spring-hateoasMaven |
through 1.5.6 | None known |
org.springframework.hateoas:spring-hateoasMaven |
2.4.0 to 2.4.1 | None known |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
1.5.6 up to 1.5.6-tuxcare.4, plus listed versions 1.5.6-tuxcare.21.5.6-tuxcare.31.5.6.tuxcare1.5.6.tuxcare.1 |
1.5.6-tuxcare.4 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.4.1 up to 2.4.1-tuxcare.2, plus listed versions 2.4.1-tuxcare.1 |
2.4.1-tuxcare.2 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.3.4 up to 2.3.4-tuxcare.1 | 2.3.4-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.0.7 up to 2.0.7-tuxcare.1 | 2.0.7-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.2.5 up to 2.2.5-tuxcare.1 | 2.2.5-tuxcare.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.1.3 up to 2.1.3-tuxcare.1 | 2.1.3-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
1.1.2.RELEASE up to 1.1.2.RELEASE-tuxcare.2, plus listed versions 1.1.2.RELEASE-tuxcare.1 |
1.1.2.RELEASE-tuxcare.2 |
org.springframework.hateoas:spring-hateoasMaven |
3.0.0 up to 3.0.4, plus listed versions 3.0.13.0.23.0.3 |
3.0.4 |
org.springframework.hateoas:spring-hateoasMaven |
2.5.0 up to 2.5.3, plus listed versions 2.5.12.5.2 |
2.5.3 |
org.springframework.hateoas:spring-hateoasMaven |
2.3.0 to 2.3.4, plus listed versions 2.3.12.3.22.3.3 |
None known |
org.springframework.hateoas:spring-hateoasMaven |
through 1.5.6, plus listed versions 0.0.0.1.1.4.TEST-RELEASE0.0.0.1.2.3-SNAPSHOT.10.0.0.1.3.0-HATEOAS-1417-SNAPSHOT.10.1.0.RELEASE0.10.0.RELEASE Show 45 moreShow less0.11.0.RELEASE0.12.0.RELEASE0.13.0.RELEASE0.14.0.RELEASE0.15.0.RELEASE0.16.0.RELEASE0.17.0.RELEASE0.18.0.RELEASE0.19.0.RELEASE0.2.0.RELEASE0.20.0.RELEASE0.21.0.RELEASE0.22.0.RELEASE0.23.0.RELEASE0.24.0.RELEASE0.25.0.RELEASE0.25.1.RELEASE0.25.2.RELEASE0.3.0.RELEASE0.4.0.RELEASE0.5.0.RELEASE0.6.0.RELEASE0.7.0.RELEASE0.8.0.RELEASE0.9.0.RELEASE1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE1.0.5.RELEASE1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.5 |
None known |
org.springframework.hateoas:spring-hateoasRoot:Maven |
before 3.0.3-aikido.1 | 3.0.3-aikido.12.5.2-aikido.12.3.3-aikido.2 |
io.root.org.springframework.hateoas:spring-hateoasRoot:Maven |
before 3.0.3-root.io.1 | 3.0.3-root.io.12.5.2-root.io.12.3.3-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41006 is a high vulnerability (CVSS 7.5) in Spring Hateoas, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in org.springframework.hateoas:spring-hateoas 3.0.4.
References
spring.io/security/cve-2026-41006
nvd.nist.gov/vuln/detail/CVE-2026-41006
github.com/spring-projects/spring-hateoas/issues/2515
Show 7 moreShow less
Left out here: 24 versions. The JSON record has them.