by Kastro
Paper/Archive/CVE-2026-41855

CVE-2026-41855

Spring Spring Framework — Spring Framework Unsafe Deserialization via Jackson JMS Converters

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 25.9.259 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Affected

ProductAffectedFixed inSource
Spring Framework7.0.0 – < 7.0.7.17.0.7.1CNA
Spring Framework6.2.0 – < 6.2.18.16.2.18.1CNA
Spring Framework6.1.0 – < 6.1.286.1.28CNA
Spring Framework5.3.0 – < 5.3.495.3.49CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vmware (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refspring.io/security/cve-2026-41855