CVE-2026-41006 Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
Spring HATEOAS deserializers ignore Jackson access controls, allowing attackers to trigger unsafe reflection and potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41006?
CVE-2026-41006 is a high-severity unsafe deserialization vulnerability in Spring HATEOAS, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.
Weakness: CWE-284
Which versions are affected by CVE-2026-41006?
10 open source packages ship an affected version, including org.springframework.hateoas:spring-hateoas. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.hateoas:spring-hateoas Maven | All versions to 1.5.6 | None |
org.springframework.hateoas:spring-hateoas Maven | All versions to 1.5.6 | None |
org.springframework.hateoas:spring-hateoas Maven | From 2.3.0 to 2.3.4 | None |
org.springframework.hateoas:spring-hateoas Maven | From 2.3.0 to 2.3.4 | None |
org.springframework.hateoas:spring-hateoas Maven | From 2.4.0 to 2.4.1 | None |
org.springframework.hateoas:spring-hateoas Maven | From 2.4.0 to 2.4.1 | None |
4 more packages
org.springframework.hateoas:spring-hateoas Maven | From 2.5.0 | 2.5.3 |
org.springframework.hateoas:spring-hateoas Maven | From 2.5.0 | 2.5.3 |
org.springframework.hateoas:spring-hateoas Maven | From 3.0.0 | 3.0.4 |
org.springframework.hateoas:spring-hateoas Maven | From 3.0.0 | 3.0.4 |
Products include Vmware Spring Hateoas.
How do I fix CVE-2026-41006?
Upgrade org.springframework.hateoas:spring-hateoas to a fixed version for your release line: 2.5.3 or 3.0.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-41006 being exploited?
There is no known exploitation of CVE-2026-41006 in the wild and no public exploit code.
Other vulnerabilities in Spring HATEOAS
Sources
Also known as CLSA-2026-1786690945, CLSA-2026-1792568406, GHSA-7fxc-486f-32q9, ROOT-APP-MAVEN-CVE-2026-41006.