Spring HATEOAS versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3 maintain an unbounded static cache of StringLinkRelation objects keyed by attacker-controlled strings. This lack of limits or throttling on resource allocation (CWE-770) can be exploited to cause denial of service by exhausting memory or other resources. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No patch or official remediation level has been disclosed as of the publication date.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting resources through unbounded caching of attacker-supplied strings. There is no impact on confidentiality or integrity reported. The primary impact is availability degradation or service outage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing application-level rate limiting or input validation to restrict attacker-controlled input that influences the cache keys. Monitor application resource usage to detect potential exploitation attempts.