Skip to content
OpenAdvisories

Product · Spring

Spring for Apache Pulsar

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-41732

    In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

    JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages ra…

    Spring Spring for Apache Pulsar org.springframework.pulsar:spring-pulsar Maven