CVE catalog
CVE-2026-41007
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.30% · Oct 25, 2026
A flaw was found in Spring HATEOAS. An attacker can exploit this vulnerability by supplying specially crafted strings, which are then used as keys in an unbounded static cache. This can lead to resource exhaustion, causing a denial of service (DoS) for the application. spring-hateoas: Spring HATEOAS: Denial of Service via unbounded static cache This is an Important denial of service flaw in Spring HATEOAS, affecting Red Hat JBoss Fuse. The vulnerability arises from an unbounded static cache that can be exhausted by attacker-supplied strings, leading to resource unavailability. This impact is considered Important due to the potential for remote, unauthenticated attackers to disrupt service. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | spring_hateoas | Not reported | 1.5.7 | fixed |
| Cpe | spring_hateoas | Not reported | 2.3.5 | fixed |
| Cpe | spring_hateoas | Not reported | 2.4.2 | fixed |
| Cpe | spring_hateoas | Not reported | 2.5.3 | fixed |
| Cpe | spring_hateoas | Not reported | 3.0.4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | spring_hateoas | cpe | Not reported | 1.5.7 | Not reported | Not reported | Not reported |
| Cpe | spring_hateoas | cpe | Not reported | 2.3.5 | Not reported | Not reported | Not reported |
| Cpe | spring_hateoas | cpe | Not reported | 2.4.2 | Not reported | Not reported | Not reported |
| Cpe | spring_hateoas | cpe | Not reported | 2.5.3 | Not reported | Not reported | Not reported |
| Cpe | spring_hateoas | cpe | Not reported | 3.0.4 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: