{"id":"CVE-2026-41006","summary":"Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration","details":"Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.\n\nAffected versions:\nSpring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.","aliases":["GHSA-7fxc-486f-32q9"],"modified":"2026-07-29T18:26:45.144072175Z","published":"2026-06-09T03:57:39.106Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"1.5.0"},{"fixed":"1.5.7"},{"introduced":"2.3.0"},{"fixed":"2.3.5"},{"introduced":"2.4.0"},{"fixed":"2.4.2"},{"introduced":"2.5.0"},{"fixed":"2.5.2.1"},{"introduced":"3.0.0"},{"fixed":"3.0.3.1"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"1.5.0"},{"fixed":"1.5.6"},{"introduced":"2.3.0"},{"fixed":"2.3.4"},{"introduced":"2.4.0"},{"fixed":"2.4.1"},{"introduced":"2.5.0"},{"fixed":"2.5.2"},{"introduced":"3.0.0"},{"fixed":"3.0.3"}],"source":"DESCRIPTION"}],"cna_assigner":"vmware","cwe_ids":["CWE-284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41006.json"},"references":[{"type":"WEB","url":"https://spring.io/security/cve-2026-41006"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41006.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41006"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-hateoas","events":[{"introduced":"b5a0e17ac58f15b58bb4f155937c067ee60ec355"},{"fixed":"011095f23c5ab0b81ef0dcb74db1301682975fb9"},{"introduced":"2e731dad7ee3640ca358bbcb9c93619b2cc56608"},{"fixed":"f1a90509ebb4ddd4328db6c51667ff1ae03d46ea"},{"introduced":"d41c32cb4f259ab6164074f8b758dc765d1e34c9"},{"fixed":"d54055469c08152dad063fd61216f5af5ee29e28"},{"introduced":"b6f8f2f85bef52611c38bb1683d68e9f1c0998ac"},{"fixed":"ed913d113c6d46ce2ddc438e036eae0eb1cf626b"},{"introduced":"a46c152499db7e3bf456c7d90238c9b9d134c634"},{"fixed":"d98396ef3680e278e23d522e9fd53c67af52b0b2"}],"database_specific":{"source":"DESCRIPTION","extracted_events":[{"introduced":"1.5.0"},{"fixed":"1.5.6"},{"introduced":"2.3.0"},{"fixed":"2.3.4"},{"introduced":"2.4.0"},{"fixed":"2.4.1"},{"introduced":"2.5.0"},{"fixed":"2.5.2"},{"introduced":"3.0.0"},{"fixed":"3.0.3"}]}}],"versions":["3.0.2","3.0.1","3.0.0","2.5.1","2.5.0","2.4.0","2.3.3","2.3.2","2.3.1","2.3.0","1.5.5","1.5.4","1.5.3","1.5.2","1.5.1","1.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41006.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}