GHSA-7fxc-486f-32q9HighCVSS 7.5

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

Published
June 9, 2026
Last Modified
July 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-41006 →

📋 Description

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

🎯 Affected products5

  • maven/org.springframework.hateoas:spring-hateoas:>= 3.0.0, <= 3.0.3
  • maven/org.springframework.hateoas:spring-hateoas:>= 2.5.0, <= 2.5.2
  • maven/org.springframework.hateoas:spring-hateoas:>= 2.3.0, <= 2.3.4
  • maven/org.springframework.hateoas:spring-hateoas:<= 1.5.6
  • maven/org.springframework.hateoas:spring-hateoas:>= 2.4.0, <= 2.4.1

🔗 References (11)