GitHub Advisoryadvisory · Maven

GHSA-439x-6767-44cv Spring HATEOAS heap exhaustion through unbounded internal caching

HIGH Published 2026-06-09 Modified 2026-07-29 Official page ↗
Aliases
CVE-2026-41007
Ecosystem
Maven
Packages
org.springframework.hateoas:spring-hateoas
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-07-29

Affected packages

• Maven org.springframework.hateoas:spring-hateoas: >= 3.0.0, < 3.0.4 → fixed in 3.0.4 • Maven org.springframework.hateoas:spring-hateoas: >= 2.5.0, < 2.5.3 → fixed in 2.5.3 • Maven org.springframework.hateoas:spring-hateoas: >= 2.3.0, <= 2.3.4 (no fix yet) • Maven org.springframework.hateoas:spring-hateoas: <= 1.5.6 (no fix yet) • Maven org.springframework.hateoas:spring-hateoas: >= 2.4.0, <= 2.4.1 (no fix yet)

Description

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Related

Alias · CVE (1)

  • CVE-2026-41007 Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References