Spring Blog

Spring HATEOAS 3.1 GA, 3.0.4, and 2.5.3 released

Releases | Oliver Drotbohm | June 08, 2026 | 1 min read | ...

On behalf of the community, I am excited to announce the availability of Spring HATEOAS 3.1 GA, 3.0.4, 2.5.3. The GA release ships the usual dependency updates and a few polishes in link parsing.

CVE reports

These releases address the following CVEs:

  • CVE-2026-41006 – Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration
  • CVE-2026-41007 – Spring HATEOAS heap exhaustion through unbounded internal caching

Find more information in the full changelogs for 3.1 GA, 3.0.4, and 2.5.3.

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all