Junglewise Threat Intelligence

CVE-2026-41006: VMware Spring HATEOAS improper access control in PropertyUtils

CVE-2026-41006 · Severity: high · CVSS 7.5 · Published 2026-06-09

Vendors: VMware.

Executive brief

Spring HATEOAS, a library used to build hypermedia-driven web APIs, contains a vulnerability in how it processes certain data formats (Collection+JSON and UBER). The software fails to respect security settings that restrict which data fields can be modified, potentially allowing an attacker to disrupt the application's availability. This could lead to service outages or system instability if an attacker sends specially crafted web requests.

Technical details

A vulnerability exists in Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method. When using Collection+JSON or UBER media type deserializers, the library performs bean property binding via reflection but fails to consult Jackson access-control annotations (such as those intended to restrict property setting). An unauthenticated remote attacker can exploit this by sending crafted JSON payloads to an endpoint that consumes these media types. The primary impact is a denial of service (Availability: High), as the improper binding can be used to manipulate object states in ways not intended by the developer. Patches are available in versions 2.5.3 and 3.0.4.

Affected products

  • VMware Spring HATEOAS 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, 3.0.0 through 3.0.3

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-29: patched

References

Related threats