CVE-2026-41007: Allocation of Resources Without Limits or Throttling

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3...

VMware Spring HATEOAS security vulnerability

VMware Spring HATEOAS is a REST API hypermedia development framework provided by the American company VMware. Vulnerabilities exist in versions 1.5.0 to 1.5.6, 2.3.0 to 2.3.4, 2.4.0 to 2.4.1, 2.5.0 to 2.5.2, and 3.0.0 to 3.0.3 of VMware Spring HATEOAS. These vulnerabilities stem from the...

PT-2026-47645

Name of the Vulnerable Software and Affected Versions Spring HATEOAS versions 1.5.0 through 1.5.6 Spring HATEOAS versions 2.3.0 through 2.3.4 Spring HATEOAS versions 2.4.0 through 2.4.1 Spring HATEOAS versions 2.5.0 through 2.5.2 Spring HATEOAS versions 3.0.0 through 3.0.3 Description Spring...

VMware Spring HATEOAS Access Control Vulnerability

VMware Spring HATEOAS is a REST API hypermedia development framework provided by the American company VMware. Vulnerabilities in access control exist in versions 1.5.0 to 1.5.6, 2.3.0 to 2.3.4, 2.4.0 to 2.4.1, 2.5.0 to 2.5.2, and 3.0.0 to 3.0.3 of VMware Spring HATEOAS. This vulnerability stems...

cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching

cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching...

cve-2026-41006 - HIGH - Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

cve-2026-41006 - HIGH - Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via reflective property binding in PropertyUtils.createObjectFromProperties. An attacker can modify security-sensitive object properties by supplying crafted...

ai.apiverse:apipulse (1.0.1), be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release) +475 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=1.5.0, <=2.5.2)

org.springframework.hateoas:spring-hateoas MAVEN version =1.5.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.21 and more Source cves: CVE-2026-41006 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +44 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (>=3.0.0-m1, <=3.0.3)

org.springframework.hateoas:spring-hateoas MAVEN version =3.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =1.0.0, =4.0, =4.0, =3.0.9, =3.0.9, =3.0.9, =3.0.0, =1.0.45, =1.0.81 and more Source cves: CVE-2026-41007 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKHATEOAS-17255295https://vu...

ai.apiverse:apipulse (1.0.1), be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release) +475 more potentially affected by CVE-2026-41007 via org.springframework.hateoas:spring-hateoas (>=1.5.0, <=2.5.2)

org.springframework.hateoas:spring-hateoas MAVEN version =1.5.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.21 and more Source cves: CVE-2026-41007 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of StringLinkRelation instances. An attacker can cause denial of service by supplying a large number of unique link relation values, causing the static cache to...

EUVD-2023-1992

Malicious code in bioql PyPI...

CVE-2023-34036

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle and possibly discard...

This Week in Spring - March 19th, 2024

Hi, Spring fans! And happy Java 22 release day to those who celebrate! I just put out a huge blog detailing many of the exciting new features in Java 22. Check it out! As usual, we've got a packed roundup to get through this week so let's dive right into it! the Spring Authorization Server 1.3.0-...

This Week in Spring - October 3rd, 2023

Hi Spring fans! Welcome to another installment of This Week in Spring! How're you doin'? I've just flown in from Singapore - where I was keynoting and presenting at SpringOne Singapore - and am now in Antwerp, Belgium for the deliriously fun Devoxx Belgium show. I've missed this show, and it's a...

Security Bulletin: Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary Multiple security vulnerabilities impacting Watson Knowledge Catalog for IBM Cloud Pak for Data. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of he...

This Week in Spring - July 18th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in crazy cool Kuala Lumpur, Malaysia. If you're around, I'll be doing a presentation this Thursday the 20th of July, and I'd love to see you there! Then, after a quick vacation, it's off to Tokyo, Japan, where I'll also b...

GHSA-7M5C-FGWF-MWPH Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle and possibly discard...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.1.release), be.personify.iam:personify-frontend (1.5.1.release) +51 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (>=2.0.0, <=2.0.4)

org.springframework.hateoas:spring-hateoas MAVEN version =2.0.0, =1.5.0.release, =1.5.0.release, =0.2.6, =1.6.9, =1.0, =1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.0, =2.0.4 - com.wizzdi:flexicore 7.0.0 and more Source cves: CVE-2023-34036 Source advisory: OSV:GHSA-7M5C-FGWF-MWPH...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.1.release), be.personify.iam:personify-frontend (1.5.1.release) +51 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (>=2.0.0, <=2.0.4)

org.springframework.hateoas:spring-hateoas MAVEN version =2.0.0, =1.5.0.release, =1.5.0.release, =0.2.6, =1.6.9, =1.0, =1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.0, =2.0.4 - com.wizzdi:flexicore 7.0.0 and more Source cves: CVE-2023-34036 Source advisory: GHSA-7M5C-FGWF-MWPH...