Spring Spring HATEOAS

• CVE-2026-41007 High 7.5 Spring HATEOAS heap exhaustion through unbounded internal caching 0.3%
• CVE-2026-41006 High 7.5 Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration 0.3%
• CVE-2023-34036 Medium 5.3 Forwarded header exploit with Spring HATEOAS on WebFlux 0.5%