Spring HATEOAS heap exhaustion through unbounded internal caching (CVE-2026-41007) | HOL Guard CVE