What is the CVSS score of EUVD-2026-35909?

EUVD-2026-35909 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring for Apache Pulsar are affected by EUVD-2026-35909?

Spring for Apache Pulsar versions 1.1.0-2.0.5 contain a remote code execution vulnerability in message header processing, exposing organizations' entire message queue infrastructure to potential…. A patch is available.

How to fix or mitigate EUVD-2026-35909?

Within 24 hours: Conduct comprehensive inventory of production, staging, and development systems using Spring for Apache Pulsar versions 1.1.0-1.1.17, 1.2.0-1.2.17, or 2.0.0-2.0.5 via dependency scanning (Maven, Gradle, SBOMs). Within 7 days: Restrict network-level access to Pulsar brokers to only authorized message producers; enable strict message header validation; implement JVM-level deserialization protections and gadget chain restrictions. Within 30 days: Monitor Spring/Pivotal security advisories daily for patch availability; prepare and test upgrade runbooks; execute upgrades to patched versions immediately upon release.

Spring for Apache Pulsar EUVD-2026-35909

| CVE-2026-41732 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-10 security@vmware.com

GHSA-gg69-9wwp-6jx2

Deserialization Apache Java Spring For Apache Pulsar

8.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:35 vuln.today

CVE Published

Jun 10, 2026 - 00:16 nvd

HIGH 8.1

DescriptionCVE.org

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.

Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.

Articles & Coverage 1

News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026

AnalysisAI

Insecure deserialization in Spring for Apache Pulsar's JsonPulsarHeaderMapper allows remote attackers to bypass trusted-package controls and potentially trigger arbitrary Java object instantiation through Pulsar message headers. The flaw stems from a prefix-based package match plus an unsafe empty-allow-list default, affecting versions 1.1.0-1.1.17, 1.2.0-1.2.17, and 2.0.0-2.0.5. No public exploit identified at time of analysis, but the CVSS 8.1 rating and CWE-502 classification place this firmly in the high-impact Java deserialization category that has historically yielded remote code execution.

Technical ContextAI

Spring for Apache Pulsar is the Spring portfolio's integration library for Apache Pulsar, a distributed messaging and streaming platform. The JsonPulsarHeaderMapper component converts Pulsar message headers into typed Java objects on the consumer side, using a 'trusted packages' allow-list to constrain which classes Jackson may instantiate during deserialization - a standard defense against the CWE-502 Deserialization of Untrusted Data class of bugs. Two distinct logic defects undermine that defense: trust is enforced via string prefix matching (so trusting 'com.example' also trusts 'com.example.attacker' and any other subpackage a consumer never intended), and an empty trusted-packages configuration silently degrades to trusting every package instead of the documented safe-default behavior. The combination effectively turns header deserialization into a broad gadget-loading surface whenever Spring Pulsar consumers process headers from a producer an attacker controls.

RemediationAI

Upgrade Spring for Apache Pulsar to a fixed release on your branch - consult https://spring.io/security/cve-2026-41732 for the exact patched versions, as the input does not enumerate them and they should not be guessed. If immediate upgrade is not feasible, explicitly configure the trustedPackages property on JsonPulsarHeaderMapper to a minimal, exhaustive allow-list of the fully qualified packages your application actually deserializes, avoiding broad parents such as 'com' or 'org' since prefix matching will pull in everything beneath them, and never leave the trusted-packages list empty since that triggers the unsafe trust-everything fallback. Where header-typed deserialization is not required, switch to a header mapper that treats all headers as raw bytes or strings, accepting that downstream code must then perform its own typed conversion. Additionally restrict which producers can publish to consumed topics via Pulsar authentication and authorization so that untrusted parties cannot inject crafted headers in the first place.