Executive brief
Spring for Apache Pulsar is a library used to integrate Java applications with the Apache Pulsar messaging system. A security flaw in how it handles message headers allows for the unintended processing of data from untrusted sources. This could allow an attacker to execute malicious code or gain unauthorized access to the system, potentially leading to a full system compromise or data theft.
Technical details
A deserialization vulnerability (CWE-502) exists in the JsonPulsarHeaderMapper component of Spring for Apache Pulsar. The component used a simple prefix check to validate trusted packages for type headers, which inadvertently allowed all subpackages of a trusted package to be deserialized. Furthermore, if the trusted-packages configuration was left empty, the system defaulted to trusting all packages instead of a secure allow-list. An attacker can exploit this by sending specially crafted Pulsar messages with headers pointing to malicious classes within an implicitly trusted subpackage. This can lead to remote code execution (RCE) if suitable gadgets are present on the classpath. The issue is resolved in versions 2.0.6 and 1.2.18.
Affected products
- Spring Spring for Apache Pulsar 2.0.0 to 2.0.5, 1.2.0 to 1.2.17, 1.1.0 to 1.1.17
Timeline
- 2026-06-09: patched: Versions 1.2.18 and 2.0.6 released
- 2026-06-10: disclosed
- 2026-06-10: advisory