What is the CVSS score of CVE-2026-41006?

CVE-2026-41006 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring HATEOAS are affected by CVE-2026-41006?

Spring HATEOAS, used in REST API frameworks across multiple versions, contains a vulnerability allowing unauthenticated users to crash affected applications through specially crafted requests.. A patch is available.

How to fix or mitigate CVE-2026-41006?

Within 24 hours: Inventory all applications using Spring HATEOAS; compare deployed versions against affected ranges (1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, 3.0.0-3.0.3) to identify exposure. Within 7 days: Deploy WAF rules to block Collection+JSON and UBER media type requests from untrusted sources; implement request payload limits and access controls on API endpoints. Within 30 days: Monitor VMware/Spring security advisories for patch releases; develop and test upgrade path to patched versions.

Spring HATEOAS CVE-2026-41006

EUVD-2026-35345 HIGH

Improper Access Control (CWE-284)

2026-06-09 vmware

GHSA-7fxc-486f-32q9

Authentication Bypass Java Spring Hateoas

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:10 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

11 maven packages depend on org.springframework.hateoas:spring-hateoas (2 direct, 9 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Denial-of-service via improper access control in Spring HATEOAS affects versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3, where the internal PropertyUtils.createObjectFromProperties method performs reflection-based bean property binding while ignoring Jackson access-control annotations (@JsonIgnore, @JsonProperty access modes). Remote unauthenticated attackers sending crafted Collection+JSON or UBER media type payloads can bind to properties the developer explicitly marked as inbound-restricted, causing high-availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Spring HATEOAS is a VMware/Broadcom-maintained library that helps Spring applications create REST representations following the HATEOAS principle, supporting hypermedia formats including HAL, Collection+JSON, and UBER. The vulnerable code path is the internal utility PropertyUtils.createObjectFromProperties, invoked by the Collection+JSON and UBER deserializers when reconstructing Java objects from incoming hypermedia payloads. Rather than delegating to Jackson's annotation-aware ObjectMapper for property assignment, the utility walks bean properties via raw Java reflection and writes to fields/setters directly - bypassing Jackson access-control metadata such as @JsonIgnore, @JsonProperty(access = WRITE_ONLY/READ_ONLY), and similar annotations. CWE-284 (Improper Access Control) captures the root cause: a security-relevant access boundary expressed via annotations is not actually enforced by the deserialization path that consumes them.

RemediationAI

Upstream fix available per vendor advisory; released patched versions are implied to be the next point releases above each affected branch (1.5.7, 2.3.5, 2.4.2, 2.5.3, 3.0.4) but those exact fix versions are not independently confirmed in the input data - consult https://spring.io/security/cve-2026-41006 for authoritative patched releases before upgrading. As a compensating control until patching, disable registration of the Collection+JSON and UBER MediaTypeConfiguration beans (e.g., remove HypermediaType.COLLECTION_JSON and HypermediaType.UBER from @EnableHypermediaSupport) which eliminates the vulnerable deserialization path entirely, at the cost of clients depending on those formats; alternatively, place a reverse-proxy filter that rejects requests with Content-Type application/vnd.collection+json or application/vnd.amundsen-uber+json on affected endpoints, which is non-invasive but only protects perimeter-facing traffic and not internal callers.