CVE-2026-41007: Spring HATEOAS Unbounded Cache Denial-of-Service Vulnerability

Technical summary

Spring HATEOAS maintains a static cache of StringLinkRelation instances that is keyed on attacker-controlled input strings without size limits. An unauthenticated, network-accessible attacker can trigger cache growth by submitting requests with varying link relation values, causing unbounded memory consumption. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and receives a CVSS 3.1 score of 7.5 (HIGH) due to its network accessibility, low attack complexity, and direct availability impact.

Business impact

Organizations deploying Spring HATEOAS face potential service disruption through memory exhaustion attacks. REST API endpoints become unresponsive or crash without authentication barriers, affecting availability for legitimate users. This is particularly critical for companies relying on Spring-based microservices for customer-facing or internal APIs, as the attack requires no credentials and can be executed remotely with minimal overhead.

Affected systems

VMware Spring HATEOAS versions 1.5.0–1.5.6, 2.3.0–2.3.4, 2.4.0–2.4.1, 2.5.0–2.5.2, and 3.0.0–3.0.3 are vulnerable. Organizations should audit their Maven or Gradle dependencies to identify which release lines are in use and cross-reference against this list. The vulnerability spans both older and recent major versions, requiring attention across diverse application portfolios.

Exploitability

Exploitation is straightforward: the attack vector is network-based, requires no authentication, and demands low complexity. An attacker needs only to craft HTTP requests with varying link relation header values or parameters to trigger cache pollution. No user interaction is required. The vulnerability is immediately actionable once a vulnerable version is deployed in a network-accessible location, making it a high-priority concern for public-facing APIs.

Remediation

Affected organizations must upgrade Spring HATEOAS to patched versions beyond the identified vulnerable ranges. Verify the exact patch versions available from the VMware Spring HATEOAS release notes and apply the latest stable release for your active version line. As an interim mitigation, implement network-level rate limiting or request filtering on endpoints that process link relations to reduce attack surface before patching becomes feasible.

Patch guidance

Consult the official VMware Spring HATEOAS repository and release notes to identify the minimum patched versions for each release line (1.5.x, 2.3.x, 2.4.x, 2.5.x, 3.0.x). Update your build configuration (pom.xml or build.gradle) to specify the patched version and re-test REST API endpoints to confirm normal hypermedia link generation. Prioritize updating to the latest stable release in your active version line to benefit from other security and stability improvements.

Detection guidance

Monitor application memory usage patterns for unexpected growth correlated with API requests containing unusual or high-cardinality link relation values. Enable debug logging in Spring HATEOAS to observe cache behavior. Search logs for requests with atypical or malformed link relation parameters. Implement heap dump analysis during suspected attacks to confirm StringLinkRelation cache bloat. Network-based detection can flag requests with repetitive variations in header or query parameters targeting link relation handling.

Why prioritize this

This vulnerability combines high exploitability (network-accessible, no auth required, low complexity) with direct availability impact. The unbounded cache is a design flaw rather than a narrow edge case, making it likely to trigger in normal operation if an attacker is present. The broad version range affected means most organizations using Spring HATEOAS have some exposure. Immediate inventory and patching efforts are warranted.

Risk score, explained

The CVSS 7.5 (HIGH) score reflects network accessibility (AV:N), low attack complexity (AC:L), no privilege or user interaction requirements (PR:N/UI:N), and direct impact on availability (A:H). The absence of confidentiality or integrity impact prevents a CRITICAL rating, but the ease of exploitation and potential for widespread disruption across Spring-based infrastructure justifies urgent remediation planning.

Frequently asked questions