Spring Security Advisories

CVE-2026-41007: Spring HATEOAS heap exhaustion through unbounded internal caching

HIGH | JUNE 02, 2026 | CVE-2026-41007

Description

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected applications are those that deserialize attacker-supplied hypermedia, for example via a @RequestBody bound to a RepresentationModel, EntityModel, or CollectionModel, or by calling Links.parse() / Link.valueOf() on a client-supplied Link header.

Affected Spring Products and Versions

Spring HATEOAS:

1.5.0 - 1.5.6
2.3.0 - 2.3.4
2.4.0 - 2.4.1
2.5.0 - 2.5.2
3.0.0 - 3.0.3

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix version	Availability
1.5.x	1.5.7	Enterprise Support Only
2.3.x	2.3.5	Enterprise Support Only
2.4.x	2.4.2	Enterprise Support Only
2.5.x	2.5.3	OSS
3.0.x	3.0.4	OSS

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

2026-06-02: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy