The vulnerability in Spring for Apache Pulsar involves the JsonPulsarHeaderMapper's method of validating trusted packages by prefix matching, which causes implicit trust of all subpackages under any trusted package. Furthermore, an empty trusted-packages configuration results in trusting all packages by default instead of applying a restrictive allow-list. This behavior enables deserialization of untrusted data, classified under CWE-502, potentially allowing attackers to execute arbitrary code or cause denial of service. Affected versions include 1.1.0 through 1.1.17, 1.2.0 through 1.2.17, and 2.0.0 through 2.0.5 of Spring for Apache Pulsar. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to perform unsafe deserialization of untrusted data, potentially leading to remote code execution, data compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using empty trusted-packages configurations and carefully restrict trusted packages to minimize exposure. Monitor vendor channels for updates and apply patches promptly once available.