Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41006Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
High 7.5
In plain English
A high-severity improper access control in Spring HATEOAS from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.hateoas:spring-hateoas | 3.0.4 | GHSA-7fxc-486f-32q9 |
| Maven | org.springframework.hateoas:spring-hateoas | 2.5.3 | GHSA-7fxc-486f-32q9 |
| Maven | org.springframework.hateoas:spring-hateoas | no fix listed | GHSA-7fxc-486f-32q9 |
| Maven | org.springframework.hateoas:spring-hateoas | no fix listed | GHSA-7fxc-486f-32q9 |
| Maven | org.springframework.hateoas:spring-hateoas | no fix listed | GHSA-7fxc-486f-32q9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring HATEOAS | 1.5.0 – before 1.5.72.3.0 – before 2.3.52.4.0 – before 2.4.22.5.0 – before 2.5.2.13.0.0 – before 3.0.3.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H