CVE-2026-41007 Spring HATEOAS heap exhaustion through unbounded internal caching
HighCVSS 7.5
EPSS 0.30%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected versions:
Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring HATEOAS | >= 1.5.0, < 1.5.7 | 1.5.7 |
| Spring HATEOAS | >= 2.3.0, < 2.3.5 | 2.3.5 |
| Spring HATEOAS | >= 2.4.0, < 2.4.2 | 2.4.2 |
| Spring HATEOAS | >= 2.5.0, < 2.5.2.1 | 2.5.2.1 |
| Spring HATEOAS | >= 3.0.0, < 3.0.3.1 | 3.0.3.1 |
| org.springframework.hateoas/spring-hateoas(Maven) | >= 3.0.0, < 3.0.4 | 3.0.4 |
| org.springframework.hateoas/spring-hateoas(Maven) | = 3.0.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 3.0.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 3.0.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 3.0.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | >= 2.5.0, < 2.5.3 | 2.5.3 |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.5.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.5.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.5.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | >= 2.3.0, <= 2.3.4 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.3.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.3.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.3.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.3.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.3.4 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | <= 1.5.6 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.0.0.1.1.4.TEST-RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.0.0.1.2.3-SNAPSHOT.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.0.0.1.3.0-HATEOAS-1417-SNAPSHOT.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.1.0.RELEASE | No fix listed |
Show 82 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.10.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.11.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.12.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.13.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.14.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.15.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.16.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.17.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.18.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.19.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.2.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.20.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.21.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.22.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.23.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.24.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.25.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.25.1.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.25.2.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.3.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.4.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.5.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.6.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.7.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.8.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 0.9.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.0.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.0.1.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.0.2.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.0.3.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.0.4.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.0.5.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.1.0.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.1.1.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.1.2.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.1.3.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.1.4.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.1.5.RELEASE | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.10 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.11 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.4 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.5 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.6 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.7 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.8 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.2.9 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.4 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.5 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.6 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.3.7 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.4.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.4.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.4.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.4.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.4.4 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.4.5 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.2 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.4 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.5 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 1.5.6 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | >= 2.4.0, <= 2.4.1 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.4.0 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | = 2.4.1 | No fix listed |
| redhat/spring-hateoas(Red Hat:jboss_fuse:7) | All versions | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | >= 3.0.0, <= 3.0.3 | No fix listed |
| org.springframework.hateoas/spring-hateoas(Maven) | >= 2.5.0, <= 2.5.2 | No fix listed |
| VMware spring hateoas | >= 1.5.0, < 1.5.7 | 1.5.7 |
| VMware spring hateoas | >= 2.3.0, < 2.3.5 | 2.3.5 |
| VMware spring hateoas | >= 2.4.0, < 2.4.2 | 2.4.2 |
| VMware spring hateoas | >= 2.5.0, < 2.5.2.1 | 2.5.2.1 |
| VMware spring hateoas | >= 3.0.0, < 3.0.3.1 | 3.0.3.1 |
References
- spring.io vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com
- github.com
- github.com patch
- github.com patch
- github.com patch
- github.com product
- github.com
- github.com
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2486715 issue-tracking
- www.cve.org
- github.com