org.springframework.boot:spring-boot-starter-data-rest (1.5.18.release), org.springframework.data:spring-data-rest-hal-browser (2.6.17.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.17.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.jknack:mwa-mongo (0.4.0), com.github.jknack:mwa-morphia (0.4.0) +14 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.5.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.jknack:mwa-mongo 0.4.0 - com.github.jknack:mwa-morph...

org.springframework.boot:spring-boot-starter-data-rest (1.5.5.release), org.springframework.data:spring-data-rest-hal-browser (2.6.5.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +110 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =1.0.1, =3.0.1.3...

cn.stylefeng.roses:kernel-logger (>=1.0.0, <=2.2.3), com.github.lujiannt:kernel-logger (1.0.0) +4 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.2.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - cn.stylefeng.roses:kernel-logger =1.0.0, =0.0.2, =0.0.2, =5.2.0-rc1,...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: OSV:GHSA-GG69-9WWP-6JX2...

com.github.hushengte:disciples-feed (1.0.5), com.github.paulcwarren:spring-content-rest (>=0.0.3, <=0.0.4) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.hushengte:disciples-feed 1.0.5 -...

com.ueboot:ueboot-generator (2.2.0), com.ueboot:ueboot-shiro (2.2.0) +13 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.15.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ueboot:ueboot-generator 2.2.0 - com.ueboot:ueboot-shir...

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

org.springframework.data:spring-data-rest-webmvc (2.0.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.springframework.boot:spring-boot-starter-data-rest (>=1.2.7.release, <=1.2.8.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.2.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.netflix.spectator:spectator-web-spring =0.41.0,...

org.springframework.boot:spring-boot-starter-data-rest (1.3.8.release), org.springframework.data:spring-data-rest-hal-browser (2.4.5.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

io.github.shuigedeng:taotao-boot-demo (2025.12), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.12, <=2026.06) +23 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=2.0.0, <=2.0.5)

org.springframework.pulsar:spring-pulsar MAVEN version =2.0.0, =2025.12, =2025.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.4.0, =1.0.0, =1.0.0, =1.0.2, =1.0.2, =1.4.5 and more Source cves: CVE-2026-41732 Source advisory: OSV:GHSA-GG69-9WWP-6JX2...

GHSA-GG69-9WWP-6JX2 Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

EUVD-2026-35909

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

org.springframework.data:spring-data-rest-webmvc (2.3.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.3.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

com.github.iaunzu:strqlbuilder (>=1.1.0, <=1.1.1), com.github.osvaldopina:linkbuilder (>=0.1.1, <=0.3.0) +58 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.9.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.iaunzu:strqlbuilder =1.1.0, =0.1.1, =1.0.5, =0.8.5,...

org.springframework.data:spring-data-rest-hal-browser (2.6.2.release), org.springframework.data:spring-data-rest-webmvc (2.6.2.release) potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...