CVE-2026-41732

Name of the Vulnerable Software and Affected Versions Spring for Apache Pulsar versions 1.1.0 through 1.1.17 Spring for Apache Pulsar versions 1.2.0 through 1.2.17 Spring for Apache Pulsar versions 2.0.0 through 2.0.5

Description JsonPulsarHeaderMapper uses a prefix check to match type headers against trusted packages, which results in any trusted package implicitly trusting all of its subpackages. This overly broad matching exposes JDK classes to deserialization. Furthermore, if the trusted-packages configuration is empty, the system defaults to trusting all packages instead of applying a safe allow-list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.