org.springframework.hateoas:spring-hateoas 2.5.2

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.hateoas:spring-hateoas package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improperly Controlled Modification of Dynamically-Determined Object Attributes Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via reflective property binding in `PropertyUtils.createObjectFromProperties()`. An attacker can modify security-sensitive object properties by supplying crafted hypermedia payloads, as property binding performed by the Collection+JSON and UBER deserializers ignores Jackson access-control annotations and sets bean properties directly through reflection. This may allow unauthorized modification of fields that developers intended to restrict from client control. Note: This is only exploitable if the application enables the COLLECTION_JSON or UBER media types, accepts a `RepresentationModel` or `EntityModel` as `@RequestBody`, and relies on Jackson annotations to protect sensitive properties while still exposing corresponding setter methods. How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes? Upgrade `org.springframework.hateoas:spring-hateoas` to version 2.5.3, 3.0.4 or higher.	[1.5.0,2.5.3)[3.0.0-M1,3.0.4)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of `StringLinkRelation` instances. An attacker can cause denial of service by supplying a large number of unique link relation values, causing the static cache to grow without limit. Repeated processing of attacker-controlled hypermedia can consume excessive memory and eventually lead to application unavailability. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.hateoas:spring-hateoas` to version 2.5.3, 3.0.4 or higher.	[1.5.0,2.5.3)[3.0.0-M1,3.0.4)

Vulnerability

Vulnerable Version

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via reflective property binding in PropertyUtils.createObjectFromProperties(). An attacker can modify security-sensitive object properties by supplying crafted hypermedia payloads, as property binding performed by the Collection+JSON and UBER deserializers ignores Jackson access-control annotations and sets bean properties directly through reflection. This may allow unauthorized modification of fields that developers intended to restrict from client control.

Note: This is only exploitable if the application enables the COLLECTION_JSON or UBER media types, accepts a RepresentationModel or EntityModel as @RequestBody, and relies on Jackson annotations to protect sensitive properties while still exposing corresponding setter methods.

How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes?

Upgrade org.springframework.hateoas:spring-hateoas to version 2.5.3, 3.0.4 or higher.

[1.5.0,2.5.3)[3.0.0-M1,3.0.4)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded caching of StringLinkRelation instances. An attacker can cause denial of service by supplying a large number of unique link relation values, causing the static cache to grow without limit. Repeated processing of attacker-controlled hypermedia can consume excessive memory and eventually lead to application unavailability.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.hateoas:spring-hateoas to version 2.5.3, 3.0.4 or higher.

[1.5.0,2.5.3)[3.0.0-M1,3.0.4)

org.springframework.hateoas:spring-hateoas@2.5.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically