Spring HATEOAS heap exhaustion through unbounded internal caching

HIGH | JUNE 08, 2026 | CVE-2026-41007

Description

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected applications are those that deserialize attacker-supplied hypermedia, for example via a @RequestBody bound to a RepresentationModel, EntityModel, or CollectionModel, or by calling Links.parse() / Link.valueOf() on a client-supplied Link header.

Affected Spring Products and Versions

Spring HATEOAS:

3.0.0 - 3.0.3
2.5.0 - 2.5.2
2.4.0 - 2.4.1
2.3.0 - 2.3.4
1.5.6 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
3.0.4	OSS
3.0.3.1	Enterprise Support Only
2.5.3	OSS
2.5.2.1	Enterprise Support Only
2.4.2	Enterprise Support Only
2.3.5	Enterprise Support Only
1.5.7	Enterprise Support Only