CVE-2026-41855High· 8.1▾ TwilightIn an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.springframework:spring-jms <= 5.3.39org.springframework:spring-jms >= 6.0.0, <= 6.1.21org.springframework:spring-jms >= 6.2.0, <= 6.2.18org.springframework:spring-jms >= 7.0.0-M1, <= 7.0.7Patched in:
org.springframework:spring-jms 6.2.19org.springframework:spring-jms 7.0.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41731High· 8.1In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
CVE-2025-15438Medium· 4.7A vulnerability was determined in PluXml up to 5.8.22
CVE-2025-26399Critical· 9.8SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine
CVE-2025-12305Medium· 6.3A vulnerability was found in quequnlong shiyi-blog up to 1.2.1
CVE-2026-47892Critical· 9.8Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-47890Critical· 9.8Spring Framework Server Sent Event stream corruption while rendering fragments