CVE-2026-41007
Spring HATEOAS heap exhaustion through unbounded internal caching
CVE-2026-41007 is a high vulnerability (CVSS 7.5) in Spring Hateoas, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in org.springframework.hateoas:spring-hateoas 3.0.4.
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spring HATEOAS heap exhaustion through unbounded internal caching
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
CVE-2026-41007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-35346
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
EUVD-2026-35346- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-439x-6767-44cv
Spring HATEOAS heap exhaustion through unbounded internal caching
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
GHSA-439x-6767-44cv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
CVE-2026-41007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Spring HATEOAS heap exhaustion through unbounded internal caching
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
CVE-2026-41007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-439x-6767-44cv
Spring HATEOAS heap exhaustion through unbounded internal caching
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
- Record
GHSA-439x-6767-44cv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 9 moreShow less
OSVCLSA-2026-1782954020 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 1.5.6-tuxcare.4.
- Record
CLSA-2026-1782954020- Updated
- 2026-11-02
OSVCLSA-2026-1786568979 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.4.1-tuxcare.1.
- Record
CLSA-2026-1786568979- Updated
- 2026-11-02
OSVCLSA-2026-1787147294 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.3.4-tuxcare.1.
- Record
CLSA-2026-1787147294- Updated
- 2026-11-02
OSVCLSA-2026-1787917768 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.0.7-tuxcare.1.
- Record
CLSA-2026-1787917768- Updated
- 2026-11-02
OSVCLSA-2026-1789455724 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.2.5-tuxcare.1.
- Record
CLSA-2026-1789455724- Updated
- 2026-11-02
OSVCLSA-2026-1791959812 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 1.1.2.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791959812- Updated
- 2026-11-02
OSVCLSA-2026-1793717781 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.1.3-tuxcare.3.
- Record
CLSA-2026-1793717781- Updated
- 2026-11-03
OSVCLSA-2026-1793731183 No score
TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 1.1.1.RELEASE-tuxcare.3.
- Record
CLSA-2026-1793731183- Updated
- 2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-41007 No score
CVE-2026-41007 in org.springframework.hateoas:spring-hateoas - Patched by Root
Root has patched CVE-2026-41007 in the org.springframework.hateoas:spring-hateoas package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41007- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.hateoas:spring-hateoasMaven |
3.0.0 to 3.0.3 | 3.0.4 |
org.springframework.hateoas:spring-hateoasMaven |
2.5.0 to 2.5.2 | 2.5.3 |
org.springframework.hateoas:spring-hateoasMaven |
2.3.0 to 2.3.4 | None known |
org.springframework.hateoas:spring-hateoasMaven |
through 1.5.6 | None known |
org.springframework.hateoas:spring-hateoasMaven |
2.4.0 to 2.4.1 | None known |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
1.5.6 up to 1.5.6-tuxcare.4, plus listed versions 1.5.6-tuxcare.21.5.6-tuxcare.31.5.6.tuxcare1.5.6.tuxcare.1 |
1.5.6-tuxcare.4 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.4.1 up to 2.4.1-tuxcare.1 | 2.4.1-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.3.4 up to 2.3.4-tuxcare.1 | 2.3.4-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.0.7 up to 2.0.7-tuxcare.1 | 2.0.7-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.2.5 up to 2.2.5-tuxcare.1 | 2.2.5-tuxcare.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
1.1.2.RELEASE up to 1.1.2.RELEASE-tuxcare.1 | 1.1.2.RELEASE-tuxcare.1 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
2.1.3 up to 2.1.3-tuxcare.3, plus listed versions 2.1.3-tuxcare.12.1.3-tuxcare.2 |
2.1.3-tuxcare.3 |
org.springframework.hateoas:spring-hateoasTuxCare:Maven |
1.1.1.RELEASE up to 1.1.1.RELEASE-tuxcare.3, plus listed versions 1.1.1.RELEASE-tuxcare.11.1.1.RELEASE-tuxcare.2 |
1.1.1.RELEASE-tuxcare.3 |
org.springframework.hateoas:spring-hateoasMaven |
3.0.0 up to 3.0.4, plus listed versions 3.0.13.0.23.0.3 |
3.0.4 |
org.springframework.hateoas:spring-hateoasMaven |
2.5.0 up to 2.5.3, plus listed versions 2.5.12.5.2 |
2.5.3 |
org.springframework.hateoas:spring-hateoasMaven |
2.3.0 to 2.3.4, plus listed versions 2.3.12.3.22.3.3 |
None known |
org.springframework.hateoas:spring-hateoasMaven |
through 1.5.6, plus listed versions 0.0.0.1.1.4.TEST-RELEASE0.0.0.1.2.3-SNAPSHOT.10.0.0.1.3.0-HATEOAS-1417-SNAPSHOT.10.1.0.RELEASE0.10.0.RELEASE Show 45 moreShow less0.11.0.RELEASE0.12.0.RELEASE0.13.0.RELEASE0.14.0.RELEASE0.15.0.RELEASE0.16.0.RELEASE0.17.0.RELEASE0.18.0.RELEASE0.19.0.RELEASE0.2.0.RELEASE0.20.0.RELEASE0.21.0.RELEASE0.22.0.RELEASE0.23.0.RELEASE0.24.0.RELEASE0.25.0.RELEASE0.25.1.RELEASE0.25.2.RELEASE0.3.0.RELEASE0.4.0.RELEASE0.5.0.RELEASE0.6.0.RELEASE0.7.0.RELEASE0.8.0.RELEASE0.9.0.RELEASE1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE1.0.5.RELEASE1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.5 |
None known |
org.springframework.hateoas:spring-hateoasRoot:Maven |
before 3.0.3-aikido.1 | 3.0.3-aikido.12.5.2-aikido.12.3.3-aikido.12.3.3-aikido.2 |
io.root.org.springframework.hateoas:spring-hateoasRoot:Maven |
before 3.0.3-root.io.1 | 3.0.3-root.io.12.5.2-root.io.12.3.3-root.io.12.3.3-root.io.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-04 | affected, aliases | OSV |
| 2026-11-03 | affected, aliases, facts | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
spring.io/security/cve-2026-41007
nvd.nist.gov/vuln/detail/CVE-2026-41007
github.com/spring-projects/spring-hateoas/issues/2514
Show 7 moreShow less
Left out here: 24 versions. The JSON record has them.