CVE-2026-41732: In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-23
Weakness: CWE-502

Description

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.

Affected products

Spring for Apache Pulsar: from 1.1.0 before 1.1.18; from 1.2.0 before 1.2.17.1; from 2.0.0 before 2.0.6 — fixed in 1.1.18, 1.2.17.1, 2.0.6
Spring for Apache Pulsar: from 2.0.0 before 2.0.5.1; from 1.2.0 before 1.2.17.1; from 1.1.0 before 1.1.18 — fixed in 2.0.5.1, 1.2.17.1, 1.1.18

How to fix

Upgrade to a fixed version: Spring for Apache Pulsar 1.1.18, 1.2.17.1, 2.0.6; Spring for Apache Pulsar 2.0.5.1, 1.2.17.1, 1.1.18. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-41732

Get alerted when CVE-2026-41732 or the next vulnerability affects your stack