What is the CVSS score of EUVD-2026-35344?

EUVD-2026-35344 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Framework are affected by EUVD-2026-35344?

Certain recent versions of Spring Framework are vulnerable to remote code execution through untrusted message processing.. A patch is available.

How to fix or mitigate EUVD-2026-35344?

Within 24 hours: Identify applications using Spring Framework versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, or 7.0.0-7.0.7 with MappingJackson2MessageConverter or JacksonJsonMessageConverter enabled. Within 7 days: Apply patch available per vendor advisory or implement network controls restricting JMS sources to trusted internal systems. Within 30 days: Verify patch deployment and document remediation status for all affected systems.

Spring Framework EUVD-2026-35344

| CVE-2026-41855 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-09 vmware

GHSA-x863-p983-p4f7

Deserialization Java Spring Framework Red Hat

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires attacker to publish to an untrusted JMS destination (PR:L) and presence of suitable classpath gadgets (AC:H), but yields full compromise once met, so C/I/A High.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 14:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 14:52 NVD

HIGH CRITICAL

CVSS changed

Jun 29, 2026 - 14:52 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:06 vuln.today

DescriptionNVD

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJsonMessageConverter) lets an attacker who controls JMS message content instantiate arbitrary classes, enabling gadget-chain attacks that can escalate to unauthorized actions or remote code execution. It affects Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7 when applications consume messages from an untrusted JMS source. There is no public exploit identified at time of analysis, and despite a 9.8 CVSS the EPSS probability is only 0.04% and CISA SSVC rates exploitation as 'none'.

Technical ContextAI

The flaw is a CWE-502 (Deserialization of Untrusted Data) issue in Spring's JMS support layer. MappingJackson2MessageConverter and the newer JacksonJsonMessageConverter use Jackson to map inbound JMS TextMessage payloads back into Java objects. When configured to resolve the target type from message metadata (e.g. a type-id header) or with permissive typing, an attacker-supplied JSON body can drive instantiation of attacker-chosen classes. If exploitable 'gadget' classes are present on the application classpath (a well-known Jackson/Java deserialization pattern), chained instantiation and property setting can trigger side effects culminating in code execution. The single CPE (cpe:2.3:a:spring:spring_framework:*) confirms the core Spring Framework artifact is the affected component, not a downstream product. The tags (Java, Deserialization, Spring Framework) align with this classic JVM polymorphic-deserialization class of bug.

RemediationAI

Vendor-released patch: upgrade to Spring Framework 5.3.49, 6.1.28, 6.2.19, or 7.0.8 (or later) per the maintenance line in use, as published in the vendor advisory at https://spring.io/security/cve-2026-41855. Where immediate upgrade is not possible, avoid configuring MappingJackson2MessageConverter or JacksonJsonMessageConverter to consume messages from JMS sources you do not fully control, and restrict JMS broker access so only trusted producers can publish to consumed destinations (network ACLs, broker authentication/authorization) - the trade-off is operational overhead and potential disruption to legitimate integrations. Additionally, lock the converter's type resolution to a fixed, expected target type rather than deriving it from message headers, and remove known deserialization gadget libraries from the classpath where feasible; note that constraining the type may break applications that legitimately rely on polymorphic message typing. Verify the exact patched version against https://nvd.nist.gov/vuln/detail/CVE-2026-41855 before deploying.