CVE-2026-41732: In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.
Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41732?
The severity of CVE-2026-41732 is rated high with a score of 8.1.
How do I fix CVE-2026-41732?
To fix CVE-2026-41732, ensure that your trusted-packages configuration correctly specifies only the packages you intend to trust and avoid empty configurations.
What are the implications of CVE-2026-41732?
CVE-2026-41732 can expose JDK classes to deserialization attacks due to overly broad trusted-package matching.
Which software is affected by CVE-2026-41732?
CVE-2026-41732 affects Spring for Apache Pulsar.
When was CVE-2026-41732 published?
CVE-2026-41732 was published on June 9, 2026.