Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-41732

In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring for Apache Pulsar

Default version status: unaffected

  • 2.0.0 to < 2.0.5.1affected
  • 1.2.0 to < 1.2.17.1affected
  • 1.1.0 to < 1.1.18affected

References