GHSA-439x-6767-44cv

Source

https://github.com/advisories/GHSA-439x-6767-44cv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-439x-6767-44cv/GHSA-439x-6767-44cv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-439x-6767-44cv

Aliases

CVE-2026-41007

Published

2026-06-09T06:31:57Z

Modified

2026-07-29T18:26:45Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Spring HATEOAS heap exhaustion through unbounded internal caching

Details

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Database specific

{
    "cwe_ids": [
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T18:06:02Z",
    "nvd_published_at": "2026-06-09T05:16:35Z",
    "severity": "HIGH"
}

References

Affected packages

Maven

org.springframework.hateoas:spring-hateoas

Package

Name: org.springframework.hateoas:spring-hateoas; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.0.4

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

Database specific

last_known_affected_version_range

"<= 3.0.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-439x-6767-44cv/GHSA-439x-6767-44cv.json"

org.springframework.hateoas:spring-hateoas

Package

Name: org.springframework.hateoas:spring-hateoas; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.3

Affected versions

2.*

2.5.0

2.5.1

2.5.2

Database specific

last_known_affected_version_range

"<= 2.5.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-439x-6767-44cv/GHSA-439x-6767-44cv.json"

org.springframework.hateoas:spring-hateoas

Package

Name: org.springframework.hateoas:spring-hateoas; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Last Affected

2.3.4

Affected versions

2.*

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-439x-6767-44cv/GHSA-439x-6767-44cv.json"

org.springframework.hateoas:spring-hateoas

Package

Name: org.springframework.hateoas:spring-hateoas; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.5.6

Affected versions

0.*

0.0.0.1.1.4.TEST-RELEASE

0.0.0.1.2.3-SNAPSHOT.1

0.0.0.1.3.0-HATEOAS-1417-SNAPSHOT.1

0.1.0.RELEASE

0.2.0.RELEASE

0.3.0.RELEASE

0.4.0.RELEASE

0.5.0.RELEASE

0.6.0.RELEASE

0.7.0.RELEASE

0.8.0.RELEASE

0.9.0.RELEASE

0.10.0.RELEASE

0.11.0.RELEASE

0.12.0.RELEASE

0.13.0.RELEASE

0.14.0.RELEASE

0.15.0.RELEASE

0.16.0.RELEASE

0.17.0.RELEASE

0.18.0.RELEASE

0.19.0.RELEASE

0.20.0.RELEASE

0.21.0.RELEASE

0.22.0.RELEASE

0.23.0.RELEASE

0.24.0.RELEASE

0.25.0.RELEASE

0.25.1.RELEASE

0.25.2.RELEASE

1.*

1.0.0.RELEASE

1.0.1.RELEASE

1.0.2.RELEASE

1.0.3.RELEASE

1.0.4.RELEASE

1.0.5.RELEASE

1.1.0.RELEASE

1.1.1.RELEASE

1.1.2.RELEASE

1.1.3.RELEASE

1.1.4.RELEASE

1.1.5.RELEASE

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-439x-6767-44cv/GHSA-439x-6767-44cv.json"

org.springframework.hateoas:spring-hateoas

Package

Name: org.springframework.hateoas:spring-hateoas; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Last Affected

2.4.1

Affected versions

2.*

2.4.0

2.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-439x-6767-44cv/GHSA-439x-6767-44cv.json"