VMware Spring Hateoas vulnerabilities

3 CVEs affecting VMware Spring Hateoas, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41007, published 2026-06-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-34036, published 2023-07-17. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures…
CVE-2026-41007, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4;…
CVE-2026-41006, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without…