Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by vmware

CVE-2026-41855Spring Framework Unsafe Deserialization via Jackson JMS Converters

High 8.1

In plain English

A high-severity unsafe deserialization in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 74.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-41855
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-41855
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-41855
Mavenorg.springframework:spring-jms7.0.8GHSA-x863-p983-p4f7
Mavenorg.springframework:spring-jmsno fix listedGHSA-x863-p983-p4f7
Mavenorg.springframework:spring-jmsno fix listedGHSA-x863-p983-p4f7
Mavenorg.springframework:spring-jms6.2.19GHSA-x863-p983-p4f7
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2026-41855
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-41855
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-41855

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – before 7.0.7.16.2.0 – before 6.2.18.16.1.0 – before 6.1.285.3.0 – before 5.3.49

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References