CVE Intelligence
Analysis AI-assisted

CVE-2026-41855: Spring Framework Unsafe Deserialization via Jackson JMS Converters

CVE-2026-41855 affects the Jackson-based JMS message converters in Spring Framework, which can instantiate arbitrary classes when JMS messages come from an untrusted environment. The NVD base score is 9.8 (critical), and the record links the flaw to gadget class deserialization that can lead to unauthorized actions. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-41855 concerns two JMS message converters in Spring Framework, MappingJackson2MessageConverter and JacksonJsonMessageConverter. According to the record, in an untrusted JMS environment they allow arbitrary class instantiation. The weakness is classified as CWE-502, Deserialization of Untrusted Data.

Impact

  • The record states that the flaw can lead to unauthorized actions through gadget class deserialization.
  • The NVD CVSS base score is 9.8 (critical). The CNA-provided score in the record is 8.1.
  • The SSVC technical impact is recorded as total.

Affected products and versions

  • The description lists Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
  • The structured affected data uses different upper boundaries: versions from 7.0.0 before 7.0.7.1, from 6.2.0 before 6.2.18.1, from 6.1.0 before 6.1.28, and from 5.3.0 before 5.3.49.
  • The two sources do not fully align, so the exact boundaries should be confirmed with the vendor advisory before making a final decision.

Exploitation status

  • The record marks the CVE as not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00328, with a percentile of 0.24671. The SSVC exploitation field is none and the automatable field is no.

Remediation and mitigation

  • Upgrade Spring Framework to a release that the vendor advisory lists as fixed for your branch: Spring security advisory.
  • Until you can patch, restrict JMS destinations so that only trusted producers can send messages to them.
  • Review where the affected converters are configured and remove or replace them where they are not needed.
  • Treat any JMS path that accepts messages from outside your trust boundary as high priority.

Detection guidance

  • Inventory applications that use Spring Framework JMS support together with Jackson converters.
  • Monitor JMS consumers for unexpected deserialization errors, unfamiliar message types, or unusual class loading.
  • Correlate consumer anomalies with message origin logs to identify untrusted senders.

Limitations of the available information

  • The fixes list in the record is empty, so no fixed version is confirmed by that field. The structured affected data implies fixed boundaries, which should be verified against the vendor advisory.
  • The record contains version boundaries that differ between the description and the structured affected data.
  • No technical proof-of-concept or exploitation telemetry is included in the record.
  • The EPSS date in the record is later than the publication date, and this should be checked against the source.

Frequently asked questions

What is the main risk of CVE-2026-41855?

According to the record, the Jackson JMS converters can instantiate arbitrary classes in an untrusted JMS environment, which can lead to unauthorized actions through gadget class deserialization.

Is this CVE known to be exploited?

The record marks it as not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Check the vendor advisory for the fixed release on your branch, upgrade Spring Framework, and restrict JMS destinations to trusted producers until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.