Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework:spring-jms

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Spring Framework Unsafe Deserialization via Jackson JMS Converters

    CVE-2026-41855 · GHSA-x863-p983-p4f7

    Affected
    • Maven org.springframework:spring-jms <= 5.3.39; >= 6.0.0, <= 6.1.21; >= 6.2.0, <= 6.2.18; >= 7.0.0-M1, <= 7.0.7
    Fixed in
    7.0.86.2.19· Partial vendor fix
    Issue
    In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

    Recommended action: Upgrade to 7.0.8 or 6.2.19 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →