CVE-2026-41855: Spring Framework Unsafe Deserialization via Jackson JMS Converters

Synopsis

Unsafe deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJsonMessageConverter) allows an attacker delivering a crafted JMS message in an untrusted broker environment to trigger arbitrary class instantiation through Jackson gadget chains. The vulnerability is reachable over the network and requires no authentication, though exploitation involves elevated complexity due to the need for a suitable gadget class on the classpath. Successful exploitation gives an attacker full read, write, and availability impact on the affected service, up to and including remote code execution. Patched-image rebuilds at versions 5.3.49, 6.1.28, 6.2.19, and 7.0.8 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted JMS message to the target service over the network via a reachable JMS broker endpoint.

• AuthenticationNot required

  No credentials are required; an unauthenticated attacker with access to the JMS broker can submit malicious messages.

• Victim interactionNot required

  No user interaction is needed; the vulnerable code path executes automatically when the application processes an incoming JMS message.

• Attack complexityDetail

  Exploitation is non-trivial: the attacker must control or compromise the JMS broker and identify a usable Jackson gadget chain present on the target application's classpath.

Blast Radius

• Reads any data accessible to the application process, including configuration secrets, session tokens, and database credentials.
• Modifies or deletes application data and filesystem content writable by the process.
• Crashes or hangs the affected service, causing denial of service for dependent consumers.
• Executes arbitrary code in the context of the application container if a suitable gadget class is present on the classpath, enabling full host compromise.