CYBERSIXT Signal Over Noise
securityonline.info 6/12/2026, 12:46:54 AM · external

Spring HATEOAS bugs let attackers bypass checks, crash servers

Spring HATEOAS bugs let attackers bypass checks, crash servers
CyberSIXT Evidence Panel
CVE Intel
CVE-2026-41006 - NVD Not in KEV 7.5 HIGH
CVE-2026-41007 - NVD Not in KEV 7.5 HIGH
CISA KEV Not in KEV
Patch Patch Available

TWO critical vulnerabilities in Spring HATEOAS have been identified: CVE-2026-41006 and CVE-2026-41007. The first allows attackers to bypass essential data checks by exploiting poor handling of Collection JSON and UBER types, potentially leading to unauthorized data modifications. The second flaw causes server crashes due to unbounded caching that enables attackers to flood memory with excessive data. Affected versions include 1.5 to 3.0; users are urged to upgrade to versions 2.5.3 or 3.0.4 to mitigate these risks.

View full article

Article by CyberSIXT