CVE-2026-41732
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The JsonPulsarHeaderMapper component matches type headers against trusted packages using a prefix check, meaning trusting any package implicitly trusts all its subpackages. Additionally, an empty trusted-packages configuration falls back to trusting all packages instead of applying a safe default allow-list.
Risk Assessment
The organization is exposed to unauthorized data access or malicious operations via injection of malicious message types, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately update Spring for Apache Pulsar to version 2.0.6 or later (for 2.0.x line) and to 1.2.18 or 1.1.18 (for older lines). After updating, explicitly configure the trusted packages list.
Original NVD description (English source)
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.