Overview
About vulnerability
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
Affected applications are those that deserialize attacker-supplied hypermedia, for example via a @RequestBody bound to a RepresentationModel, EntityModel, or CollectionModel, or by calling Links.parse() / Link.valueOf() on a client-supplied Link header.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Boot @ 2.6.15 (+1847 more)