{"action":"Upgrade org.springframework.hateoas:spring-hateoas to 2.5.3 (2.x) or 3.0.4 (3.x) or later.","affected":[{"fixed":"3.0.4","introduced":"3.0.0"},{"fixed":"2.5.3","introduced":"2.5.0"},{"introduced":"2.3.0","last_affected":"2.3.4"},{"introduced":"0","last_affected":"1.5.6"},{"introduced":"2.4.0","last_affected":"2.4.1"}],"component":"org.springframework.hateoas:spring-hateoas","cve_ids":["CVE-2026-41006"],"ecosystem":"Maven","epss":0.00277,"exploited":false,"fixed_versions":["3.0.4","2.5.3"],"ghsa_id":"GHSA-7fxc-486f-32q9","id":"tcs_01M5N8J9WYBPNKRV1PPMCWP1A4","modified_at":"2026-07-29T18:26:45.144072Z","published_at":"2026-06-09T06:31:57Z","references":["https://osv.dev/vulnerability/GHSA-7fxc-486f-32q9","https://nvd.nist.gov/vuln/detail/CVE-2026-41006","https://github.com/spring-projects/spring-hateoas/issues/2515","https://github.com/spring-projects/spring-hateoas/issues/2516","https://github.com/spring-projects/spring-hateoas/issues/2517","https://github.com/spring-projects/spring-hateoas/commit/2c127edd741e43e6e6f06f4081af92d400209990","https://github.com/spring-projects/spring-hateoas/commit/87d73a7af52d70e51823f44a67371b7a8a54b7c1","https://github.com/spring-projects/spring-hateoas/commit/d8050eedca1c92e1839f18ec1f7e0eecfb511389","https://github.com/spring-projects/spring-hateoas","https://github.com/spring-projects/spring-hateoas/releases/tag/2.5.3","https://github.com/spring-projects/spring-hateoas/releases/tag/3.0.4","https://spring.io/security/cve-2026-41006"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7fxc-486f-32q9","url":"https://osv.dev/vulnerability/GHSA-7fxc-486f-32q9"}],"summary":"Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration"}