CVE-2026-41732
1 advisory.
Maven/org.springframework.pulsar:spring-pulsar CVE-2026-41732: high 8.1
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
Action: Upgrade org.springframework.pulsar:spring-pulsar to 1.2.18 (1.x) or 2.0.6 (2.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.0.6 | - |
| 1.2.0 | 1.2.18 | - |
| 0 | - | 1.1.17 |
Fixed versions
| 2.0.6 | 1.2.18 |
Sources
- osv: GHSA-gg69-9wwp-6jx2
- https://nvd.nist.gov/vuln/detail/CVE-2026-41732
- https://github.com/spring-projects/spring-pulsar
- https://github.com/spring-projects/spring-pulsar/releases/tag/v1.2.18
- https://github.com/spring-projects/spring-pulsar/releases/tag/v2.0.6
- https://spring.io/security/cve-2026-41732
CVE-2026-41732 · published · modified · JSON