org.springframework.pulsar vulnerabilities

Products

• org.springframework.pulsar/spring-pulsar 1

Latest org.springframework.pulsar CVEs

Newest publication first

1. CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

   Published 2026-06-09

   High·CVSS 8.1 EPSS 0.35%

   JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.