org.apache.camel:camel-amqp (2.5.0), org.apache.camel:camel-example-cxf (2.5.0) +29 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.0.4.release)

org.springframework:spring-jms MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-amqp 2.5.0 - org.apache.camel:camel-example-cxf 2.5.0 -...

com.espertech:esperio-springjms (>=4.8.0, <=7.1.0), org.broadleafcommerce:broadleaf-admin-module (>=2.0.0-ga, <=2.1.0-ga) +31 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.1.1.release)

org.springframework:spring-jms MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.espertech:esperio-springjms =4.8.0, =2.0.0-ga, =2.0.0-ga, =2.0.0-ga, =2.0.0-ga,...

com.centurylink.mdw:mdw-common (>=6.0.03, <=6.0.04), io.fabric8.quickstarts:springboot-camel-amq (>=2.2.138, <=2.2.149) +14 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.2.7.release)

org.springframework:spring-jms MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.centurylink.mdw:mdw-common =6.0.03, =2.2.138, =0.1.18, =1.3.6.release, =1.3.6.release,...

com.almis.awe:awe-annotation (>=4.11.3, <=4.12.0), com.almis.awe:awe-annotations-spring-boot-starter (>=4.11.3, <=4.12.0) +627 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (>=6.2.0, <=6.2.18)

org.springframework:spring-jms MAVEN version =6.2.0, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.12.0 and more Source cves: CVE-2026-41855 Source advisory: MEND:CVE-2026-41855...

CVE-2026-41855

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

CVE-2026-41855

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-amqp (2.12.0), com.almis.awe.clients:test-react (>=0.0.13, <=1.0.5) +708 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (>=6.1.0, <=6.2.18)

org.springframework:spring-jms MAVEN version =6.1.0, =0.0.13, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.12.0 and more Source cves: CVE-2026-41855 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254113...

Deserialization of Untrusted Data

Overview org.springframework:spring-jms is a maven plugin for Spring JMS. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via deserialization in MappingJackson2MessageConverter and JacksonJsonMessageConverter within an untrusted JMS environment. An attacker c...

com.atomikos:transactions-spring-boot4 (6.0.1), com.atomikos:transactions-spring-boot4-integration-tests (6.0.1) +427 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (>=7.0.0-m7, <=7.0.7)

org.springframework:spring-jms MAVEN version =7.0.0-m7, =7.0.0-beta.1, =3.0.0, =4.0.0-m2, =4.0.0-m2, =0.17.0, =26.1.0, =2.0.0, =2.5.0 - io.kaoto.forage:forage-jms 1.5.0 and more Source cves: CVE-2026-41855 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254113...

org.apache.activemq:activemq-camel (5.15.14), org.apache.activemq:activemq-http (5.15.14) +5 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.29.release)

org.springframework:spring-messaging MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.activemq:activemq-camel 5.15.14 - org.apache.activemq:activemq-http...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (>=4.1.0.release_1, <=4.1.0.release_5), org.jiucai:appframework (2.0.0) +2 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.0.release)

org.springframework:spring-messaging MAVEN version 4.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms...

org.apache.cxf.systests:cxf-systests-uncategorized (3.2.14), org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (4.3.27.release_1) +5 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.27.release)

org.springframework:spring-messaging MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.cxf.systests:cxf-systests-uncategorized 3.2.14 -...