---
id: CVE-2026-41855
title: >-
  In an untrusted JMS environment,
  org.springframework.jms.support.converter.MappingJackson2MessageConverter and
  org.springframework.jms.support.converter.JacksonJsonMessageConverter allow
  arbitrary class instantiation, which can lead to u…
summary: >-
  In an untrusted JMS environment,
  org.springframework.jms.support.converter.MappingJackson2MessageConverter and
  org.springframework.jms.support.converter.JacksonJsonMessageConverter allow
  arbitrary class instantiation, which can lead to u…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
published: '2026-06-09'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41855'
references:
  - url: 'https://spring.io/security/cve-2026-41855'
    label: security@vmware.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41855'
  - url: >-
      https://github.com/spring-projects/spring-framework/commit/9bec52b1ec741976658e916850b31f41afd2da2d
  - url: 'https://github.com/advisories/GHSA-x863-p983-p4f7'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00288
epssPercentile: 0.21654
ingestedAt: '2026-06-29T14:58:26.149Z'
aliases:
  - GHSA-x863-p983-p4f7
ecosystem: maven
vendor: springframework
product: 'org.springframework:spring-jms'
affected:
  - 'org.springframework:spring-jms <= 5.3.39'
  - 'org.springframework:spring-jms >= 6.0.0, <= 6.1.21'
  - 'org.springframework:spring-jms >= 6.2.0, <= 6.2.18'
  - 'org.springframework:spring-jms >= 7.0.0-M1, <= 7.0.7'
patched:
  - 'org.springframework:spring-jms 6.2.19'
  - 'org.springframework:spring-jms 7.0.8'
---

## Overview

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-41855)

Affected packages:

- `org.springframework:spring-jms <= 5.3.39`
- `org.springframework:spring-jms >= 6.0.0, <= 6.1.21`
- `org.springframework:spring-jms >= 6.2.0, <= 6.2.18`
- `org.springframework:spring-jms >= 7.0.0-M1, <= 7.0.7`

Patched in:

- `org.springframework:spring-jms 6.2.19`
- `org.springframework:spring-jms 7.0.8`

Source: https://github.com/advisories/GHSA-x863-p983-p4f7