CVE-2026-41007 - Vulnerability Details - OpenCVE

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Spring	Spring Hateoas

No data.

No data.

References

Link	Providers
https://spring.io/security/cve-2026-41007

History

Tue, 09 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 09 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spring Spring spring Hateoas
Vendors & Products		Spring Spring spring Hateoas

Tue, 09 Jun 2026 04:45:00 +0000

Type	Values Removed	Values Added
Description		Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Title		Spring HATEOAS heap exhaustion through unbounded internal caching
Weaknesses		CWE-770
References		https://spring.io/security/cve-2026-41007
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2026-06-09T04:00:47.095Z

Updated: 2026-06-09T13:20:25.239Z

Reserved: 2026-04-16T02:19:16.426Z

Link: CVE-2026-41007

Vulnrichment

Updated: 2026-06-09T13:20:20.691Z

NVD

Status : Awaiting Analysis

Published: 2026-06-09T05:16:35.033

Modified: 2026-06-09T13:49:39.993

Link: CVE-2026-41007

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41007", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-04-16T02:19:16.426Z", "datePublished": "2026-06-09T04:00:47.095Z", "dateUpdated": "2026-06-09T13:20:25.239Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-09T04:00:47.095Z"}, "title": "Spring HATEOAS heap exhaustion through unbounded internal caching", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can exhaust heap memory by supplying arbitrary strings that grow the unbounded StringLinkRelation cache, causing denial of service."}]}], "affected": [{"vendor": "Spring", "product": "Spring HATEOAS", "defaultStatus": "unaffected", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "1.5.7", "versionType": "custom"}, {"status": "affected", "version": "2.3.0", "lessThan": "2.3.5", "versionType": "custom"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.2", "versionType": "custom"}, {"status": "affected", "version": "2.5.0", "lessThan": "2.5.3", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.\n\nAffected versions:\nSpring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.\n\nAffected versions:\nSpring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3."}]}], "references": [{"url": "https://spring.io/security/cve-2026-41007"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T13:20:13.843253Z", "id": "CVE-2026-41007", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T13:20:25.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T13:20:13.843253Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T13:20:20.691Z"}}], "cna": {"title": "Spring HATEOAS heap exhaustion through unbounded internal caching", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can exhaust heap memory by supplying arbitrary strings that grow the unbounded StringLinkRelation cache, causing denial of service."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring HATEOAS", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "1.5.7", "versionType": "custom"}, {"status": "affected", "version": "2.3.0", "lessThan": "2.3.5", "versionType": "custom"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.2", "versionType": "custom"}, {"status": "affected", "version": "2.5.0", "lessThan": "2.5.3", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-41007"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.\n\nAffected versions:\nSpring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.", "supportingMedia": [{"type": "text/html", "value": "Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.\n\nAffected versions:\nSpring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-09T04:00:47.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41007", "state": "PUBLISHED", "dateUpdated": "2026-06-09T13:20:25.239Z", "dateReserved": "2026-04-16T02:19:16.426Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-06-09T04:00:47.095Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}