CVE-2026-41732 - In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
CVE ID :CVE-2026-41732 Published : June 10, 2026, 12:16 a.m. | 59 minutes ago Description :JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty...