Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework.pulsar:spring-pulsar

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

    CVE-2026-41732 · GHSA-gg69-9wwp-6jx2

    Affected
    • Maven org.springframework.pulsar:spring-pulsar >= 2.0.0, <= 2.0.5; >= 1.2.0, <= 1.2.17; <= 1.1.17
    Fixed in
    1.2.182.0.6· Partial vendor fix
    Issue
    JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.

    Recommended action: Upgrade to 2.0.6 or 1.2.18 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →