Reflection-Based Property Binding Vulnerability in Spring HATEOAS
CVE-2026-41006

7.5HIGH

Key Information:

Vendor

Spring

Status
Spring Hateoas
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41006?

The vulnerability in Spring HATEOAS arises from the PropertyUtils.createObjectFromProperties method, which allows for bean property binding to occur through reflection without adequately checking Jackson's access-control annotations. This oversight can enable unauthorized manipulation of properties, posing potential security risks to applications relying on this library. Affected versions span from 1.5.0 to 3.0.3, making it essential for users to address this issue promptly to safeguard their applications.

Affected Version(s)

Spring HATEOAS 1.5.0 < 1.5.7

Spring HATEOAS 2.3.0 < 2.3.5

Spring HATEOAS 2.4.0 < 2.4.2

References

https://spring.io/security/cve-2026-41006

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.