CVE-2026-41855: Spring Framework Unsafe Deserialization via Jackson JMS Converters

June 9, 2026 (updated September 8, 2026)

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

References

github.com/advisories/GHSA-x863-p983-p4f7
github.com/spring-projects/spring-framework/commit/9bec52b1ec741976658e916850b31f41afd2da2d
nvd.nist.gov/vuln/detail/CVE-2026-41855
spring.io/security/cve-2026-41855

Code Behaviors & Features

Detect and mitigate CVE-2026-41855 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →