CVE-2026-41732: spring spring for apache pulsar Deserialization of Untrusted Data
Vulnerability summary
CVE-2026-41732 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in spring spring for apache pulsar. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities.
Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 27-06-2026Last modifiedVulnerability information updated.
Description
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.09 pp
From 0.35% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.springframework.pulsar1 product
- spring-pulsar≥ 2.0.0, < 2.0.6 | ≥ 1.2.0, < 1.2.18 | ≤ 1.1.17
Spring1 product
- spring for apache pulsar≥ 2.0.0, < 2.0.5.1 | ≥ 1.2.0, < 1.2.17.1 | ≥ 1.1.0, < 1.1.18
Vmware1 product
- spring_for_apache_pulsar≥ 1.1.0, < 1.1.18 | ≥ 1.2.0, < 1.2.17.1 | ≥ 2.0.0, < 2.0.6
3 vendors · 3 products
