io.github.shuigedeng:taotao-boot-demo (2025.12), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.12, <=2026.06) +23 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=2.0.0, <=2.0.5)

org.springframework.pulsar:spring-pulsar MAVEN version =2.0.0, =2025.12, =2025.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.4.0, =1.0.0, =1.0.0, =1.0.2, =1.0.2, =1.4.5 and more Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.11), io.github.shuigedeng:taotao-boot-starter-mq-pulsar (>=2025.02, <=2025.11) +7 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.2.0, <=1.2.17)

org.springframework.pulsar:spring-pulsar MAVEN version =1.2.0, =2025.02, =2025.02, =2025.02, =2025.02, =3.4.0, =3.4.0, =4.2.2, =1.2.0, =1.2.0, =1.2.17 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

org.springframework.boot:spring-boot-starter-pulsar (>=3.3.0, <=3.3.13), org.springframework.boot:spring-boot-starter-pulsar-reactive (>=3.3.0, <=3.3.13) +3 more potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar (>=1.1.0, <=1.1.13)

org.springframework.pulsar:spring-pulsar MAVEN version =1.1.0, =3.3.0, =3.3.0, =1.1.0, =1.1.0, =1.1.13 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

org.springframework.boot:spring-boot-starter-pulsar-reactive (>=3.3.0, <=3.3.13) potentially affected by CVE-2026-41732 via org.springframework.pulsar:spring-pulsar-reactive (>=1.1.0, <=1.1.13)

org.springframework.pulsar:spring-pulsar-reactive MAVEN version =1.1.0, =3.3.0, =3.3.13 Source cves: CVE-2026-41732 Source advisory: MEND:CVE-2026-41732...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41731

Spring for Apache Kafka vulnerable due to overly broad trusted-package matching in JsonKafkaHeaderMapper and deprecated DefaultKafkaHeaderMapper: they compare type headers against trusted packages with a prefix check, causing any trusted package to implicitly trust all subpackages. When combined ...

CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

cn.aradin:aradin-spring-actuator-starter (>=1.0.1, <=1.0.3), cn.caijava:caijava-all (>=1.0.1, <=1.0.3) +430 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=2.8.0, <=2.8.11)

org.springframework.kafka:spring-kafka MAVEN version =2.8.0, =1.0.1, =1.0.1, =0.0.2, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.0.3, =1.0.3, =3.16.2, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-41731 Source advisory: MEND:CVE-2026-41731...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

com.buession.cas:cas-server-support-logging (>=3.0.0, <=3.0.1), com.buession.cas:cas-server-support-logging-core (>=3.0.0, <=3.0.1) +101 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=2.9.0, <=2.9.13)

org.springframework.kafka:spring-kafka MAVEN version =2.9.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.1.34, =1.3.0, =1.1.3, =1.2.3 - com.infobip.kafkistry:kafkistry-app 0.3.0 - com.infobip.kafkistry:kafkistry-auditing 0.3.0 - com.infobip.kafkistry:kafkistry-consume 0.3.0 -...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +407 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=3.3.0, <=3.3.15)

org.springframework.kafka:spring-kafka MAVEN version =3.3.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =2.2.1, =8.15.0, =8.15.0, =8.15.0, =8.4.0, =11.11.0 and more Source cves: CVE-2026-41731 Source advisory: MEND:CVE-2026-41731...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41730 Source advisory: MEND:CVE-2026-41730...