Spring for Apache Pulsar EUVD-2026-35909

Exploitation requires (1) a Spring for Apache Pulsar consumer on a vulnerable version (1.1.0-1.1.17, 1.2.0-1.2.17, or 2.0.0-2.0.5) that uses JsonPulsarHeaderMapper to deserialize message headers; (2) the attacker can publish messages to a topic that consumer reads - either directly through Pulsar producer access, via a compromised upstream producer, or because the topic accepts untrusted input; and (3) either trustedPackages is configured with a parent package whose subpackages contain an exploitable class, or trustedPackages is left empty (triggering the unsafe trust-everything fallback). Practical code execution further requires a usable deserialization gadget on the consumer's classpath, which is the primary reason CVSS scores AC:H. Deployments that authenticate Pulsar producers and tightly scope topic publish permissions materially reduce reachability even before patching.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H signals a network-reachable, unauthenticated path with high attack complexity and full CIA impact on the consumer JVM - typical of a Java deserialization issue that requires the right gadget chain on the consumer's classpath. No EPSS, KEV, SSVC, or POC data was provided, so exploitation likelihood signals are absent and cannot be cited; absence of POC is not evidence one will not appear, given how well-trodden Jackson polymorphic deserialization gadgets are. The realistic risk depends heavily on deployment context: exposed Pulsar consumers that ingest headers from untrusted producers and run on classpaths containing common gadget-laden libraries (Spring, Commons Collections, etc.) should treat this as a priority, while internal consumers with strictly controlled producers face a lower (but non-zero) blast radius. AC:H reflects that an attacker still needs both reachable header ingestion and a viable gadget chain, which moderates raw severity but does not negate it.

An attacker with the ability to publish to a Pulsar topic consumed by a vulnerable Spring for Apache Pulsar application crafts a message whose header type metadata references a class living under (or prefix-matching) a trusted package, or any class at all if the consumer left trustedPackages empty. When the JsonPulsarHeaderMapper deserializes the header on the consumer JVM, Jackson instantiates the attacker-chosen type, and if a suitable gadget chain exists on the consumer's classpath this can chain into arbitrary code execution in the consumer process. No public exploit identified at time of analysis, but Java JSON-deserialization gadget research is mature and the AC:H rating largely reflects gadget-availability dependence rather than novel difficulty.