CVE-2026-41006: VMware Spring HATEOAS improper access control in PropertyUtils

CVE-2026-41006 · Severity: high · CVSS 7.5 · Published 2026-06-09

Spring HATEOAS, a library used to build hypermedia-driven web APIs, contains a vulnerability in how it processes certain data formats (Collection+JSON and UBER). The software fails to respect security settings that restrict which data fields can be modified, potentially allowing an attacker to disrupt the application's availability. This could lead to service outages or system instability if an attacker sends specially crafted web requests.

Technologies: org.springframework.hateoas:spring-hateoas (Maven). Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41006 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41006 being exploited in the wild.
How severe is CVE-2026-41006?
High severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?
org.springframework.hateoas:spring-hateoas (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.0.4; VMware Spring HATEOAS 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, 3.0.0 through 3.0.3, 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Is there a fix for CVE-2026-41006?
Yes. org.springframework.hateoas:spring-hateoas (Maven): upgrade to 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41006 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41006?
Check whether you run org.springframework.hateoas:spring-hateoas (Maven) or VMware Spring HATEOAS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.hateoas:spring-hateoas (Maven): upgrade to 3.0.4 or later
    # set org.springframework.hateoas:spring-hateoas to 3.0.4 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method. When using Collection+JSON or UBER media type deserializers, the library performs bean property binding via reflection but fails to consult Jackson access-control annotations (such as those intended to restrict property setting). An unauthenticated remote attacker can exploit this by sending crafted JSON payloads to an endpoint that consumes these media types. The primary impact is a denial of service (Availability: High), as the improper binding can be used to manipulate object states in ways not intended by the developer. Patches are available in versions 2.5.3 and 3.0.4.

Affected products

  • VMware Spring HATEOAS 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, 3.0.0 through 3.0.3

Identifiers

  • CVE-2026-41006
  • GHSA-7fxc-486f-32q9

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.