What is the CVSS score of EUVD-2026-35346?

EUVD-2026-35346 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring HATEOAS are affected by EUVD-2026-35346?

Spring HATEOAS, a Java REST API framework used by many organizations, is vulnerable to remote denial-of-service attacks that do not require authentication.. A patch is available.

How to fix or mitigate EUVD-2026-35346?

Within 24 hours: Inventory all applications using Spring HATEOAS and identify which are running versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, or 3.0.0-3.0.3. Within 7 days: Implement network-based rate limiting on internet-facing endpoints and deploy application-level request filtering to restrict and validate link relation inputs. Within 30 days: Develop an upgrade path to Spring HATEOAS versions outside the affected ranges or deploy compensating controls to sanitize and limit link relation strings in user input.

Spring HATEOAS EUVD-2026-35346

| CVE-2026-41007 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-09 vmware

GHSA-439x-6767-44cv

Denial Of Service Java Spring Hateoas

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:09 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

11 maven packages depend on org.springframework.hateoas:spring-hateoas (2 direct, 9 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Memory exhaustion in Spring HATEOAS versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3 allows remote unauthenticated attackers to cause denial of service by sending requests with attacker-controlled link relation strings that accumulate indefinitely in an unbounded static cache of StringLinkRelation instances. With a CVSS 7.5 (high availability impact) and no public exploit identified at time of analysis, the issue is straightforward to trigger against any internet-facing Spring HATEOAS endpoint that derives link relations from request data. Not listed in CISA KEV.

Technical ContextAI

Spring HATEOAS is a VMware/Pivotal Java library that helps Spring-based REST APIs construct hypermedia-driven responses (HAL, HAL-FORMS, Collection+JSON, etc.) by adding typed links to resources. The library models a link's relation type (rel) via the StringLinkRelation class, and to avoid allocating duplicate instances it keeps a process-wide static cache keyed by the rel string. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the cache has no size cap, no LRU eviction, and no validation of the key, so every distinct attacker-supplied rel value produces a new permanent entry in the JVM heap. Because the cache is static, entries are pinned for the lifetime of the process and are unreachable for garbage collection, eventually exhausting heap and triggering OutOfMemoryError. Affected CPE is cpe:2.3:a:spring:spring_hateoas:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade Spring HATEOAS to a fixed release on each maintained branch per the vendor advisory at https://spring.io/security/cve-2026-41007 - specifically a version newer than 1.5.6 (1.5.x line), 2.3.4 (2.3.x), 2.4.1 (2.4.x), 2.5.2 (2.5.x), or 3.0.3 (3.0.x); exact fix versions should be confirmed from that advisory before deployment. If immediate upgrade is not possible, the practical compensating control is to stop deriving LinkRelation values from untrusted input: refactor controllers/representation assemblers so rel strings come exclusively from server-side constants or enums, validate inbound rel parameters against an allowlist before passing them to LinkRelation.of() or StringLinkRelation, and aggressively rate-limit or WAF-filter endpoints that accept client-supplied relation names - note this requires code review and may break legitimate clients that send custom rels. Operationally, set conservative JVM -Xmx limits with automated restart on OutOfMemoryError to bound damage until patching.