Description

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Affected Spring Products and Versions

Spring Framework:

• 7.0.0 - 7.0.7
• 6.2.0 - 6.2.18
• 6.1.0 - 6.1.27
• 5.3.0 - 5.3.48

Versions that are no longer supported are also affected.

Mitigation

For a trusted JMS environment (the most common use case), no mitigation steps are necessary.

For an untrusted JMS environment, users of affected versions should upgrade to the corresponding fixed version and limit the packages authorized for deserialization using the new setTrustedPackages(String... trustedPackages) methods.

Credit

This issue was responsibly reported by wo1enca1ca1.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1

History

• 2026-06-08: Initial vulnerability report published.