CVE-2026-41007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41007
Aliases
Downstream
CLSA (8)
ROOT (1)
Published
2026-06-09T04:00:47Z
Modified
2026-10-28T02:30:47Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Spring HATEOAS heap exhaustion through unbounded internal caching
Details

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Database specific 
{
    "cna_assigner": "vmware",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41007.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "1.5.0"
                        },
                        {
                            "fixed": "1.5.7"
                        },
                        {
                            "introduced": "2.3.0"
                        },
                        {
                            "fixed": "2.3.5"
                        },
                        {
                            "introduced": "2.4.0"
                        },
                        {
                            "fixed": "2.4.2"
                        },
                        {
                            "introduced": "2.5.0"
                        },
                        {
                            "fixed": "2.5.2.1"
                        },
                        {
                            "introduced": "3.0.0"
                        },
                        {
                            "fixed": "3.0.3.1"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-hateoas

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-hateoas
Events
Introduced
b5a0e17ac58f15b58bb4f155937c067ee60ec355
Last Affected
011095f23c5ab0b81ef0dcb74db1301682975fb9
Introduced
2e731dad7ee3640ca358bbcb9c93619b2cc56608
Last Affected
f1a90509ebb4ddd4328db6c51667ff1ae03d46ea
Introduced
d41c32cb4f259ab6164074f8b758dc765d1e34c9
Last Affected
d54055469c08152dad063fd61216f5af5ee29e28
Introduced
b6f8f2f85bef52611c38bb1683d68e9f1c0998ac
Last Affected
ed913d113c6d46ce2ddc438e036eae0eb1cf626b
Introduced
a46c152499db7e3bf456c7d90238c9b9d134c634
Last Affected
d98396ef3680e278e23d522e9fd53c67af52b0b2
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "last_affected": "1.5.6"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "2.3.0"
                },
                {
                    "last_affected": "2.3.4"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "2.4.0"
                },
                {
                    "last_affected": "2.4.1"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "2.5.0"
                },
                {
                    "last_affected": "2.5.2"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.0.3"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

1.*
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
2.*
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.5.0
2.5.1
2.5.2
3.*
3.0.0
3.0.1
3.0.2
3.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41007.json"