Spring HATEOAS heap exhaustion through unbounded internal caching
CVE-2026-41007

7.5HIGH

Key Information:

What is CVE-2026-41007?

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Spring HATEOAS 1.5.0 < 1.5.7

Spring HATEOAS 2.3.0 < 2.3.5

Spring HATEOAS 2.4.0 < 2.4.2

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

CVE-2026-41007 Data