Spring discloses deserialization flaws in Kafka header mappers and JMS converters
Spring disclosed two high-severity unsafe deserialization vulnerabilities affecting widely used messaging components: CVE-2026-41731 in Spring for Apache Kafka and CVE-2026-41855 in the Spring Framework. The Kafka issue stems from overly broad trusted-package matching in JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper, where prefix-based checks caused trust in a package to extend to all subpackages. Spring said a malicious producer could abuse crafted Kafka header values together with Jackson's default bean deserialization to make consumers instantiate arbitrary JDK classes, and assigned the flaw CWE-502 with a CVSS:3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
The related Spring Framework flaw affects Jackson-based JMS message converters in untrusted JMS environments, where deserialization of gadget classes can enable arbitrary class instantiation and unauthorized actions. Affected Kafka versions include 4.0.0-4.0.5, 3.3.0-3.3.15, 3.2.0-3.2.13, 2.9.0-2.9.13, and 2.8.0-2.8.11, while Spring recommended upgrading Kafka deployments to fixed releases such as 4.0.6 and 3.3.16, with commercial fixes for other branches. The JMS converter issue impacts Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48, extending the exposure across multiple supported and legacy release lines.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
VMware receives vulnerability report for CVE-2026-41731
The CVE-2026-41731 vulnerability report was received by security@vmware.com. The flaw affects multiple Spring for Apache Kafka versions and can allow deserialization of arbitrary JDK types through crafted Kafka header values.
Spring publishes CVE-2026-41731 advisory and fixes
Spring disclosed CVE-2026-41731, a high-severity deserialization flaw in Spring for Apache Kafka caused by overly broad trusted-package matching in header mappers. The advisory recommended upgrading to fixed releases including 4.0.6 and 3.3.16, with corresponding commercial fixes for other supported branches.
Spring receives report for CVE-2026-41855
A vulnerability report for CVE-2026-41855 affecting Spring Framework JMS message converters was received by security@vmware.com. The issue involves unsafe deserialization via Jackson-based JMS converters in untrusted JMS environments.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
CVE-2026-41731 - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
cvefeed.io
Open sourceCVE-2026-41731: In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
spring.io
Open sourceCVE-2026-41855 - Spring Framework Unsafe Deserialization via Jackson JMS Converters
cvefeed.io
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Camel Deserialization Flaws Expose JMS, Mina, and Infinispan Deployments to RCE
Apache disclosed three unsafe deserialization vulnerabilities in **Apache Camel** that can lead to remote code execution in deployments using `camel-mina`, JMS-related components, and `camel-infinispan`. **CVE-2026-40473** affects `camel-mina`, where `MinaConverter.toObjectInput()` wraps network-supplied TCP or UDP data in `java.io.ObjectInputStream` without `ObjectInputFilter` or class-loading restrictions; a crafted serialized Java object can execute during `readObject()`. **CVE-2026-40860** affects `camel-jms`, `camel-sjms`, `camel-sjms2`, and `camel-amqp`, where Camel deserializes JMS `ObjectMessage` payloads through `ObjectMessage.getObject()` with the default `mapJmsMessage` option enabled and without filtering or allow/deny lists, allowing an attacker who can publish to a consumed queue or topic to trigger code execution if a gadget chain is present. Apache also disclosed **CVE-2026-40858** in `camel-infinispan`, where the ProtoStream-based remote aggregation repository deserializes data from a remote Infinispan cache using `java.io.ObjectInputStream` without an input filter; an attacker able to write to the cache can inject a malicious serialized object that executes during normal `get` or `recover` operations. The affected versions span multiple Camel release lines, including `3.0.0` and later for the JMS issue, `3.0.0` and later for `camel-mina`, and `4.0.0` and later for `camel-infinispan`, with fixes released in **4.20.0** and backported to supported streams including **4.14.6/4.14.7** and **4.18.2**. Apache tracks the flaws as `CAMEL-23319`, `CAMEL-23321`, and `CAMEL-23322`, with reports credited to researchers from **Securin** and **Innora Pte. Ltd.**
Apr 27, 2026
Spring patches LDAP auth bypass and multiple DoS flaws across Framework and Data
Spring disclosed a broad set of vulnerabilities across **Spring Framework**, **Spring Data Commons**, and **Spring LDAP**, including a high-severity authentication bypass tracked as `CVE-2026-41720`. The LDAP flaw allows login with a valid username and an empty or null password when the backing LDAP server permits unauthenticated binds, affecting authentication flows that use `AbstractContextSource`, `LdapTemplate`, or `LdapClient`. Spring also fixed a low-severity WebFlux session fixation issue (`CVE-2026-41839`) tied to compromised subdomains, and an information disclosure bug (`CVE-2026-41841`) in Spring MVC and WebFlux where shared static-resource caches could expose protected files if a public resource with the same name had already been cached. Several denial-of-service issues were patched at the same time. In Spring Framework, `CVE-2026-41840` can leak memory through malicious multipart requests in WebFlux, while `CVE-2026-41842` can tie up HTTP connections through slow resolution of versioned file-system resources in Spring MVC or WebFlux. In Spring Data Commons, `CVE-2026-41695`, `CVE-2026-41711`, `CVE-2026-41716`, and `CVE-2026-41721` can be triggered by attacker-controlled property paths, sort parameters, property names, or `@ProjectedPayload` data binding, leading to stack overflows, heap exhaustion, or excessive memory allocation when applications expose those inputs to untrusted users. Spring urged customers to upgrade to fixed releases, including Framework `7.0.8`, `6.2.19`, and `6.1.28`, Data Commons `4.0.6` and `3.5.12`, and LDAP `2.4.5`, `3.2.18`, `3.3.8`, or `4.0.4`, with some older branches receiving fixes only through commercial support.
Jun 11, 2026
Spring discloses Spring AI injection flaw and Spring gRPC security context issues
Spring published three security advisories covering **Spring AI** and **Spring gRPC**, including `CVE-2026-40967`, a flaw in VectorStore `FilterExpressionConverter` implementations that can let attackers manipulate generated vector store queries because keys and values are not properly escaped. The issue affects Spring AI versions `1.0.0` through `1.0.5` and `1.1.0` through `1.1.4`, and is fixed in `1.0.6` and `1.1.5`. External vulnerability tracking describes the bug as a high-severity code or query injection risk with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L` and maps it to `CWE-94`. Spring also disclosed two **Spring gRPC** vulnerabilities: `CVE-2026-40968`, in which `SecurityContext` data can leak across requests after an authorization failure, and `CVE-2026-40969`, where an `AuthenticationException` message may be reflected back to a remote client. Together, the advisories point to risks of query manipulation, cross-request security context exposure, and unintended error-message disclosure in applications built on affected Spring components.
Apr 28, 2026