Insecure Trusted-Package Validation

Spring for Apache Pulsar is vulnerable to an insecure trusted-package validation. The vulnerability is due to JsonPulsarHeaderMapper using a prefix-based check for trusted packages and treating an empty trusted-packages configuration as trusting all packages, which allows an attacker to potential...

Unsafe Deserialization

Spring for Apache Kafka is vulnerable to an unsafe deserialization. The vulnerability is due to improper trusted-package matching in JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper, where prefix-based checks implicitly trusted subpackages and, combined with Jackson's default bea...