Executive brief
Spring HATEOAS, a library used to build hypermedia-driven web APIs, is vulnerable to a denial-of-service attack. An attacker can send specially crafted requests that cause the application to consume all available memory (heap exhaustion). This can lead to application crashes, service outages, and significant impacts on business operations and availability.
Technical details
Spring HATEOAS contains a resource exhaustion vulnerability (CWE-770) within its StringLinkRelation component. The library maintains a static, unbounded cache that stores StringLinkRelation instances using keys derived directly from user-supplied input. A remote, unauthenticated attacker can exploit this by sending a large volume of unique strings in API requests, causing the cache to grow until the Java heap is exhausted. This results in a Denial of Service (DoS) condition. The issue is addressed in versions 2.5.3 and 3.0.4 by improving the caching mechanism.
Affected products
- Spring Spring HATEOAS 1.5.0 - 1.5.6, 2.3.0 - 2.3.4, 2.4.0 - 2.4.1, 2.5.0 - 2.5.2, 3.0.0 - 3.0.3
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-29: patched
References
- https://spring.io/security/cve-2026-41007
- https://github.com/spring-projects/spring-hateoas/issues/2514
- https://github.com/spring-projects/spring-hateoas/issues/2518
- https://github.com/spring-projects/spring-hateoas/issues/2519
- https://github.com/spring-projects/spring-hateoas/commit/668fd3282e1c7ffc817499b4b3d85d3aa21c0c2e