Improve GHSA-x863-p983-p4f7

Author: julianladisch

advisories/unreviewed/2026/06/GHSA-x863-p983-p4f7/GHSA-x863-p983-p4f7.json

@@ -1,24 +1,109 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x863-p983-p4f7",
-  "modified": "2026-06-09T06:31:58Z",
+  "modified": "2026-06-09T06:32:07Z",
   "published": "2026-06-09T06:31:58Z",
   "aliases": [
     "CVE-2026-41855"
   ],
-  "details": "In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.",
+  "summary": "Unsafe Deserialization via Jackson JMS Converters",
+  "details": "In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.\n\nMitigation\n\nFor a trusted JMS environment (the most common use case), no mitigation steps are necessary.\n\nFor an untrusted JMS environment, users of affected versions should upgrade to the corresponding fixed version and limit the packages authorized for deserialization using the new setTrustedPackages(String... trustedPackages) methods.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.0.7.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 7.0.8"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.2.0"
+            },
+            {
+              "fixed": "6.2.18.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.1.0"
+            },
+            {
+              "fixed": "6.1.28"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.3.49"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41855"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/spring-projects/spring-framework/commit/9bec52b1ec741976658e916850b31f41afd2da2d"
+    },
     {
       "type": "WEB",
       "url": "https://spring.io/security/cve-2026-41855"