CVE-2026-41007: Spring HATEOAS heap exhaustion through unbounded internal caching

Synopsis

Heap exhaustion vulnerability in Spring HATEOAS affects versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3. The library maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings; a remote, unauthenticated attacker can flood this cache over the network with no authentication required. Successful exploitation exhausts JVM heap memory, crashing or severely degrading the affected service. Patched-image rebuilds at versions 1.5.7, 2.3.5, 2.4.2, 2.5.3, and 3.0.4 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Spring HATEOAS service over the network; the vulnerability is exposed on any network-accessible endpoint that processes attacker-supplied link relation strings.

• AuthenticationNot required

  No account or credentials are needed; the cache-flooding request can be submitted by any unauthenticated caller.

• Victim interactionNot required

  No user action is required; the attacker sends requests directly to the service without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• Exhausts JVM heap memory on the targeted service, forcing an out-of-memory crash or sustained garbage-collection pauses that make the service unavailable.
• Denial of service affects all users of the application instance, not just the attacker's own requests.
• No confidential data is read and no data is modified; impact is limited to availability.