High7.5VMware (Broadcom)

High [CVE-2026-41006] Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type…

This high-severity VMware (Broadcom) advisory covers CVE-2026-41006.

CVE-2026-41006 Published Jun 9, 2026Updated by vendor Jun 27, 2026

CVE-2026-41006

Affected products & platforms

VMware (Broadcom)Unclassified

Open vendor advisory

Android app · Google Play

Monitor future VMware (Broadcom) CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected versions

1.5.0
2.3.0
2.4.0
2.5.0
3.0.0

NVD record · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

NVD record · high-confidence parse· fetched 2 months ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

NVD record · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.