CVE-2026-41732 Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
Attackers can achieve remote code execution via unsafe deserialization in Spring for Apache Pulsar due to overly broad trusted-package matching.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41732?
CVE-2026-41732 is a high-severity unsafe deserialization vulnerability in Spring for Apache Pulsar, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.
Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.
Weakness: CWE-502
Which versions are affected by CVE-2026-41732?
6 open source packages ship an affected version, including org.springframework.pulsar:spring-pulsar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.pulsar:spring-pulsar Maven | All versions to 1.1.17 | None |
org.springframework.pulsar:spring-pulsar Maven | All versions to 1.1.17 | None |
org.springframework.pulsar:spring-pulsar Maven | From 1.2.0 | 1.2.18 |
org.springframework.pulsar:spring-pulsar Maven | From 1.2.0 | 1.2.18 |
org.springframework.pulsar:spring-pulsar Maven | From 2.0.0 | 2.0.6 |
org.springframework.pulsar:spring-pulsar Maven | From 2.0.0 | 2.0.6 |
Products include Vmware Spring for Apache Pulsar.
How do I fix CVE-2026-41732?
Upgrade org.springframework.pulsar:spring-pulsar to a fixed version for your release line: 1.2.18 or 2.0.6.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-41732 being exploited?
There is no known exploitation of CVE-2026-41732 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1788508154, CLSA-2026-1790933698, CLSA-2026-1792130659, CLSA-2026-1792598107, GHSA-gg69-9wwp-6jx2, ROOT-APP-MAVEN-CVE-2026-41732.