HIGHCVSS 7.5EPSS 0.3%

CVE-2026-41006

CVE-2026-41006 updated by NVD

Published: 2026-06-09
Modified: 2026-07-29
EPSS percentile: 20%
Sources: github-advisory, nvd

Summary

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.springframework.hateoas:spring-hateoas	—	3.0.4, 2.5.3

Remediation: Upgrade to 3.0.4 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-41006

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.