Threats affecting pkg:maven/org.springframework.hateoas/spring-hateoas

CVE-2026-41007 is a high-severity vulnerability in Spring HATEOAS where an unbounded static cache of StringLinkRelation instances is maintained using attacker-supplied strings. This affects multiple versions from 1.5.0 through 3.0.3. The vulnerability can lead to resource exhaustion due to allocation without limits or throttling.

CVE-2026-41006 is a high severity vulnerability in Spring HATEOAS affecting versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3. The issue arises from the internal PropertyUtils.createObjectFromProperties method, which performs bean property binding via reflection without respecting Jackson access-control annotations. This improper access control can lead to denial of service impacts. No official patch or remediation guidance is currently available.