CVE-2026-41732CWE-502

In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

High · published June 9, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.

Affected versions:

Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-06-09T23:49Z
EPSS history
Timeline
  • 09 JUN 23:49Z
    In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
    cvelistv5