CLSA-2026-1788508154 TuxCare security update for org.springframework.pulsar (1 CVE)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 1 CVE. Fixed in 1.2.13-tuxcare.4...

CLSA-2026-1777941833 TuxCare security update for org.springframework.pulsar (2 CVEs)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 2 CVEs. Fixed in 1.1.13-tuxcare.1...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: GHSA-GG69-9WWP-6JX2...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: OSV:GHSA-GG69-9WWP-6JX2...

io.github.shuigedeng:taotao-cloud-starter-mq-pulsar (>=2023.12, <=2024.02), io.github.shuigedeng:taotao-cloud-starter-mq-stream (>=2024.01, <=2024.02) +5 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.0.0, <=1.1.13)

org.springframework.pulsar:spring-pulsar MAVEN version =1.0.0, =2023.12, =2024.01, =3.2.0, =3.2.0, =4.1.0, =1.0.0, =1.1.0, =1.1.13 Source cves: CVE-2026-41732 Source advisory: OSV:GHSA-GG69-9WWP-6JX2...

org.springframework.pulsar:spring-pulsar-reactive (0.1.0), org.springframework.pulsar:spring-pulsar-reactive-spring-boot-starter (0.1.0) +1 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (0.1.0)

org.springframework.pulsar:spring-pulsar MAVEN version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.pulsar:spring-pulsar and may be impacted: - org.springframework.pulsar:spring-pulsar-reactive 0.1.0 -...

VMware Spring for Apache Pulsar 代码问题漏洞

VMware Spring for Apache Pulsar is a Pulsar messaging integration framework developed by the company VMware. Versions of VMware Spring for Apache Pulsar such as 2.0.0, 1.2.0, and 1.1.0 have code vulnerabilities. These vulnerabilities stem from the use of JsonPulsarHeaderMapper to check header typ...

io.github.shuigedeng:taotao-boot-demo (2025.12), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.12, <=2026.06) +23 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=2.0.0, <=2.0.5)

org.springframework.pulsar:spring-pulsar MAVEN version =2.0.0, =2025.12, =2025.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.4.0, =1.0.0, =1.0.0, =1.0.2, =1.0.2, =1.4.5 and more Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

org.springframework.boot:spring-boot-starter-pulsar-reactive (>=3.3.0, <=3.3.13) potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar-reactive (>=1.1.0, <=1.1.13)

org.springframework.pulsar:spring-pulsar-reactive MAVEN version =1.1.0, =3.3.0, =3.3.13 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

io.github.shuigedeng:taotao-boot-demo (2025.12), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.12, <=2026.06) +25 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=2.0.0-m1, <=2.0.5)

org.springframework.pulsar:spring-pulsar MAVEN version =2.0.0-m1, =2025.12, =2025.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.4.0, =1.0.0, =1.0.0, =1.0.2, =1.0.2, =1.4.5 and more Source cves: CVE-2026-41732 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKPULSAR-17306370...

Deserialization of Untrusted Data

Overview org.springframework.pulsar:spring-pulsar is a Spring Pulsar Core Affected versions of this package are vulnerable to Deserialization of Untrusted Data via trusted package validation in JsonPulsarHeaderMapper. An attacker can trigger deserialization of unintended classes by supplying...