Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.7.40 Vulnerability Details CVEID:CVE-2026-41003 DESCRIPTION: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

CVE-2026-41007

creationtimestamp| type| source ---|---|--- 2026-06-09 08:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mntq6af5ab2n...

CVE-2026-41007

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3...

CVE-2026-41007

Technical details are not publicly available in the provided documents. Monitor for updates.

com.bgiddens:spring-data-rest-utils (>=0.0.1-BETA <=0.0.7-BETA), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (=3.0.0) +44 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (>=3.0.0-M1 <=3.0.3)

org.springframework.hateoas:spring-hateoas MAVEN version =3.0.0-M1, =0.0.1-BETA, =4.0, =4.0, =3.0.9, =3.0.9, =3.0.9, =3.0.0, =1.0.45, =1.0.78 and more Source cves: CVE-2026-41007 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKHATEOAS-17255295https://vulners.com/snyk/SNYK:JAVA-O...