CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41837

CVE-2026-41837 impacts Spring Data REST where the Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not apply Jackson customizations before passing them to Querydsl. Affected versions include Spring Data REST 3.7.0–3.7.19; 4.3.0–4.3.16; 4.4...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +76 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2026-41837...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +24 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.0.5, =6.2.1, =6.2.12 and more Source cves: CVE-2026-41837 Source advisory: MEND:CVE-2...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +55 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =2.0.0, =2.0.4 - com.gitlab.mattldulany:sharedresources 2.0.0 - com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example 3.0.7 -...

CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

org.springframework.boot:spring-boot-starter-pulsar (>=3.3.0, <=3.3.13), org.springframework.boot:spring-boot-starter-pulsar-reactive (>=3.3.0, <=3.3.13) +3 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.1.0, <=1.1.13)

org.springframework.pulsar:spring-pulsar MAVEN version =1.1.0, =3.3.0, =3.3.0, =1.1.0, =1.1.0, =1.1.13 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

io.github.shuigedeng:taotao-boot-demo (2025.12), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.12, <=2026.06) +23 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=2.0.0, <=2.0.5)

org.springframework.pulsar:spring-pulsar MAVEN version =2.0.0, =2025.12, =2025.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.4.0, =1.0.0, =1.0.0, =1.0.2, =1.0.2, =1.4.5 and more Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

org.springframework.boot:spring-boot-starter-pulsar-reactive (>=3.3.0, <=3.3.13) potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar-reactive (>=1.1.0, <=1.1.13)

org.springframework.pulsar:spring-pulsar-reactive MAVEN version =1.1.0, =3.3.0, =3.3.13 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +3 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar-reactive (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar-reactive MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.5.14 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

CVE-2026-41731

Spring for Apache Kafka vulnerable due to overly broad trusted-package matching in JsonKafkaHeaderMapper and deprecated DefaultKafkaHeaderMapper: they compare type headers against trusted packages with a prefix check, causing any trusted package to implicitly trust all subpackages. When combined ...

CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

CVE-2026-41731

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...