CVE-2026-41006

Name of the Vulnerable Software and Affected Versions Spring HATEOAS versions 1.5.0 through 1.5.6 Spring HATEOAS versions 2.3.0 through 2.3.4 Spring HATEOAS versions 2.4.0 through 2.4.1 Spring HATEOAS versions 2.5.0 through 2.5.2 Spring HATEOAS versions 3.0.0 through 3.0.3

Description The internal createObjectFromProperties() function in the PropertyUtils class, utilized by the UBER and Collection+JSON media type deserializers, performs bean property binding through reflection. This process occurs without considering Jackson access-control annotations, which are used to restrict access to specific object properties during serialization and deserialization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.