GHSA-7fxc-486f-32q9

Suggest an improvement
Source
https://github.com/advisories/GHSA-7fxc-486f-32q9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7fxc-486f-32q9/GHSA-7fxc-486f-32q9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7fxc-486f-32q9
Aliases
Published
2026-06-09T06:31:57Z
Modified
2026-07-29T18:16:35.051734695Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Details

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Database specific 
{
    "github_reviewed_at": "2026-07-29T18:02:37Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-284"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2026-06-09T05:16:34Z"
}
References

Affected packages

Maven
org.springframework.hateoas:spring-hateoas

Package

Name
org.springframework.hateoas:spring-hateoas
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.4

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7fxc-486f-32q9/GHSA-7fxc-486f-32q9.json"
last_known_affected_version_range 
"<= 3.0.3"
org.springframework.hateoas:spring-hateoas

Package

Name
org.springframework.hateoas:spring-hateoas
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.5.0
Fixed
2.5.3

Affected versions

2.*
2.5.0
2.5.1
2.5.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7fxc-486f-32q9/GHSA-7fxc-486f-32q9.json"
last_known_affected_version_range 
"<= 2.5.2"
org.springframework.hateoas:spring-hateoas

Package

Name
org.springframework.hateoas:spring-hateoas
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Last affected
2.3.4

Affected versions

2.*
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7fxc-486f-32q9/GHSA-7fxc-486f-32q9.json"
org.springframework.hateoas:spring-hateoas

Package

Name
org.springframework.hateoas:spring-hateoas
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.5.6

Affected versions

0.*
0.0.0.1.1.4.TEST-RELEASE
0.0.0.1.2.3-SNAPSHOT.1
0.0.0.1.3.0-HATEOAS-1417-SNAPSHOT.1
0.1.0.RELEASE
0.2.0.RELEASE
0.3.0.RELEASE
0.4.0.RELEASE
0.5.0.RELEASE
0.6.0.RELEASE
0.7.0.RELEASE
0.8.0.RELEASE
0.9.0.RELEASE
0.10.0.RELEASE
0.11.0.RELEASE
0.12.0.RELEASE
0.13.0.RELEASE
0.14.0.RELEASE
0.15.0.RELEASE
0.16.0.RELEASE
0.17.0.RELEASE
0.18.0.RELEASE
0.19.0.RELEASE
0.20.0.RELEASE
0.21.0.RELEASE
0.22.0.RELEASE
0.23.0.RELEASE
0.24.0.RELEASE
0.25.0.RELEASE
0.25.1.RELEASE
0.25.2.RELEASE
1.*
1.0.0.RELEASE
1.0.1.RELEASE
1.0.2.RELEASE
1.0.3.RELEASE
1.0.4.RELEASE
1.0.5.RELEASE
1.1.0.RELEASE
1.1.1.RELEASE
1.1.2.RELEASE
1.1.3.RELEASE
1.1.4.RELEASE
1.1.5.RELEASE
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7fxc-486f-32q9/GHSA-7fxc-486f-32q9.json"
org.springframework.hateoas:spring-hateoas

Package

Name
org.springframework.hateoas:spring-hateoas
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.hateoas/spring-hateoas

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.4.0
Last affected
2.4.1

Affected versions

2.*
2.4.0
2.4.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-7fxc-486f-32q9/GHSA-7fxc-486f-32q9.json"