Spring HATEOAS versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3 maintain an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. This lack of limits or throttling on resource allocation (CWE-770) can result in denial of service through resource exhaustion. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability allows an attacker to cause a denial of service by exhausting server resources through unbounded caching of attacker-controlled strings. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or input validation to limit attacker-supplied strings that could cause unbounded cache growth. Monitor for updates from the Spring project regarding official fixes.