From 8aa66afb6f2cd69aed5c0a9e942f79b1743f0dd6 Mon Sep 17 00:00:00 2001
From: julianladisch <533612+julianladisch@users.noreply.github.com>
Date: Tue, 16 Jun 2026 15:24:48 +0200
Subject: [PATCH] Improve GHSA-x863-p983-p4f7

---
 .../GHSA-x863-p983-p4f7.json                  | 91 ++++++++++++++++++-
 1 file changed, 88 insertions(+), 3 deletions(-)

diff --git a/advisories/unreviewed/2026/06/GHSA-x863-p983-p4f7/GHSA-x863-p983-p4f7.json b/advisories/unreviewed/2026/06/GHSA-x863-p983-p4f7/GHSA-x863-p983-p4f7.json
index dce31bce37589..0aed10f191b6d 100644
--- a/advisories/unreviewed/2026/06/GHSA-x863-p983-p4f7/GHSA-x863-p983-p4f7.json
+++ b/advisories/unreviewed/2026/06/GHSA-x863-p983-p4f7/GHSA-x863-p983-p4f7.json
@@ -1,24 +1,109 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x863-p983-p4f7",
-  "modified": "2026-06-09T06:31:58Z",
+  "modified": "2026-06-09T06:32:07Z",
   "published": "2026-06-09T06:31:58Z",
   "aliases": [
     "CVE-2026-41855"
   ],
-  "details": "In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.",
+  "summary": "Unsafe Deserialization via Jackson JMS Converters",
+  "details": "In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.\n\nMitigation\n\nFor a trusted JMS environment (the most common use case), no mitigation steps are necessary.\n\nFor an untrusted JMS environment, users of affected versions should upgrade to the corresponding fixed version and limit the packages authorized for deserialization using the new setTrustedPackages(String... trustedPackages) methods.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.0.7.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 7.0.8"
+      }
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.2.0"
+            },
+            {
+              "fixed": "6.2.18.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.1.0"
+            },
+            {
+              "fixed": "6.1.28"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-jms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.3.49"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41855"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/spring-projects/spring-framework/commit/9bec52b1ec741976658e916850b31f41afd2da2d"
+    },
     {
       "type": "WEB",
       "url": "https://spring.io/security/cve-2026-41855"