Security Bulletin: Vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas. Vulnerabilities include resource exhaustion and...

ROOT-APP-MAVEN-CVE-2026-41007 CVE-2026-41007 in org.springframework.hateoas:spring-hateoas - Patched by Root

Root has patched CVE-2026-41007 in the org.springframework.hateoas:spring-hateoas package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41006 CVE-2026-41006 in org.springframework.hateoas:spring-hateoas - Patched by Root

Root has patched CVE-2026-41006 in the org.springframework.hateoas:spring-hateoas package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Multiple Security Vulnerabilities in Spring HATEOAS Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-41006 DESCRIPTION: Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type...

CLSA-2026-1789455724 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.2.5-tuxcare.1...

CLSA-2026-1787917768 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.0.7-tuxcare.1...

CLSA-2026-1787147294 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.3.4-tuxcare.1...

CVE-2026-41007

A flaw was found in Spring HATEOAS. An attacker can exploit this vulnerability by supplying specially crafted strings, which are then used as keys in an unbounded static cache. This can lead to resource exhaustion, causing a denial of service DoS for the application. Mitigation To mitigate the ri...

CLSA-2026-1786690945 TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.4.1-tuxcare.2...

PT-2026-80162

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.4.1-tuxcare.2...

CLSA-2026-1786568979 TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.4.1-tuxcare.1...

PT-2026-80128

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.4.1-tuxcare.1...

CLSA-2026-1782954020 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 1.5.6-tuxcare.4...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-hateoas jar (CVE-2026-41006, CVE-2026-41007)

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41006 and CVE-2026-41007 reported for spring-hateoas-2.4.1.jar, spring-hateoas-2.5.2.jar . Vulnerability Details CVEID:CVE-2026-41006 DESCRIPTION: Spring HATEOAS's internal PropertyUtils.createObjectFromPropertie...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.4.20 Vulnerability Details CVEID:CVE-2026-41003 DESCRIPTION: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.7.40 Vulnerability Details CVEID:CVE-2026-41003 DESCRIPTION: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3...

Spring HATEOAS heap exhaustion through unbounded internal caching

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3...

GHSA-7FXC-486F-32Q9 Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3...

CVE-2026-41007

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3...