Spring for Apache Pulsar Deserialization Vulnerability Advisory (CVE-2026-41732)

Vulnerability Overview CVE ID: CVE-2026-41732 Publication Date: June 9, 2026 Description: In Spring for Apache Pulsar, uses prefix checking to match type headers against trusted packages. This implies that trusting any package implicitly trusts all its sub-packages. Furthermore, an empty configuration falls back to trusting all packages instead of applying a secure default. Combined with Jackson’s default bean deserialization, a producer can provide crafted header values that cause the consumer to deserialize arbitrary JDK types, including those with side-effectful constructors (such as classes that allocate file descriptors or generate thread pools). Affected Scope Affected Products and Versions: - Spring for Apache Pulsar: - 2.0.0 – 2.0.5 - 1.2.0 – 1.2.17 - 1.1.0 – 1.1.17 - End-of-life versions are also affected. Remediation Mitigation: - Affected versions should be upgraded to the corresponding patched versions. - Specific patched versions are as follows: - 2.0.x → 2.0.6 (OSS), 2.0.5.1 (Commercial) - 1.2.x → 1.2.18 (OSS), 1.2.17.1 (Commercial) - 1.1.x → 1.1.18 (Commercial) Other Mitigation Steps: No additional mitigation steps are available. References NVD Link History 2026-06-09: Initial vulnerability report published. Report a Vulnerability For reporting security vulnerabilities in Spring projects, please refer to the Security Policy. --- Summary This vulnerability involves in Spring for Apache Pulsar. Improper handling of trusted packages may lead to the deserialization of arbitrary JDK types, posing a security risk. Affected versions must be upgraded to the specified patched versions to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Spring for Apache Pulsar Deserialization Vulnerability Advisory (CVE-2026-41732)