37366 matches found
CVE-2026-59275: Deserialization of Untrusted Data
A single hostile AMQP message can terminate the entire consumer JVM System.exit99, not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...
PT-2026-82417
Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka version 4.1.0 Spring for Apache Kafka versions 4.0.0 through 4.0.6 Spring for Apache Kafka versions 3.0.0 through 3.3.16 Spring for Apache Kafka versions 2.9.0 through 2.9.14 Spring for Apache Kafka versions 2.8.12 and...
Chronicle Wire 2026.8 Class Instantiation
Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation during untyped deserialization. Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation durin...
CVE-2026-78257: Deserialization of Untrusted Data
Contributor PHP Object Injection in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-47856: Deserialization of Untrusted Data
Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...
CVE-2026-47864: Deserialization of Untrusted Data
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
PT-2026-82394
Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description The...
PT-2026-82714
Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
PT-2026-82696
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...
PT-2026-82715
Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0 Description When the store is configured as a Spring-managed bea...
CVE-2026-59306: Deserialization of Untrusted Data
Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-47878: Deserialization of Untrusted Data
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...
CVE-2026-47875: Deserialization of Untrusted Data
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...
CVE-2026-78292: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...
PT-2026-82725
Name of the Vulnerable Software and Affected Versions Spring Integration versions 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description The...
CVE-2026-78286: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...
PT-2026-84872
Уязвимость компонента FilteredObjectInputStream библиотеки журналирования Java-программ Apache Log4j2 связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...
CVE-2026-59307: Deserialization of Untrusted Data
An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...
PT-2026-82650
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover if possible. Attackers can...