CVE-2026-41855: Spring Framework Unsafe Deserialization via Jackson JMS Converters
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41855?
CVE-2026-41855 has a severity rating of high with a score of 8.1.
How do I fix CVE-2026-41855?
To mitigate CVE-2026-41855, ensure that your application does not allow untrusted JMS environments and restrict the usage of unsafe deserialization.
What software is affected by CVE-2026-41855?
CVE-2026-41855 affects the Spring Framework, specifically the MappingJackson2MessageConverter and JacksonJsonMessageConverter classes.
What kind of risk does CVE-2026-41855 pose?
CVE-2026-41855 poses a risk of unauthorized actions through arbitrary class instantiation via gadget class deserialization in insecure JMS setups.
When was CVE-2026-41855 published?
CVE-2026-41855 was published on June 9, 2026.