CVE-2026-41007: VMware Spring HATEOAS resource exhaustion in StringLinkRelation cache

CVE-2026-41007 · Severity: high · CVSS 7.5 · Published 2026-06-09

Spring HATEOAS, a library used to build hypermedia-driven web APIs, is vulnerable to a denial-of-service attack. An attacker can send specially crafted requests that cause the application to consume all available memory (heap exhaustion). This can lead to application crashes, service outages, and significant impacts on business operations and availability.

Technologies: org.springframework.hateoas:spring-hateoas (Maven). Vendors: Maven, Spring, VMware.

Quick answers

Is CVE-2026-41007 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41007 being exploited in the wild.
How severe is CVE-2026-41007?
High severity, with a CVSS score of 7.5, published 9 June 2026.
Which products and versions are affected?
org.springframework.hateoas:spring-hateoas (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.0.4; Spring HATEOAS 1.5.0 - 1.5.6, 2.3.0 - 2.3.4, 2.4.0 - 2.4.1, 2.5.0 - 2.5.2, 3.0.0 - 3.0.3; VMware Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Is there a fix for CVE-2026-41007?
Yes. org.springframework.hateoas:spring-hateoas (Maven): upgrade to 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41007 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41007?
Check whether you run org.springframework.hateoas:spring-hateoas (Maven), Spring HATEOAS or VMware Spring HATEOAS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.hateoas:spring-hateoas (Maven): upgrade to 3.0.4 or later
    # set org.springframework.hateoas:spring-hateoas to 3.0.4 in your pom.xml or build.gradle

Technical details

Spring HATEOAS contains a resource exhaustion vulnerability (CWE-770) within its StringLinkRelation component. The library maintains a static, unbounded cache that stores StringLinkRelation instances using keys derived directly from user-supplied input. A remote, unauthenticated attacker can exploit this by sending a large volume of unique strings in API requests, causing the cache to grow until the Java heap is exhausted. This results in a Denial of Service (DoS) condition. The issue is addressed in versions 2.5.3 and 3.0.4 by improving the caching mechanism.

Affected products

  • Spring Spring HATEOAS 1.5.0 - 1.5.6, 2.3.0 - 2.3.4, 2.4.0 - 2.4.1, 2.5.0 - 2.5.2, 3.0.0 - 3.0.3

Identifiers

  • CVE-2026-41007
  • GHSA-439x-6767-44cv

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.