This vulnerability (CWE-502) exists in the Spring Framework's JMS support, specifically in the MappingJackson2MessageConverter and JacksonJsonMessageConverter classes. When used in an untrusted JMS environment, these converters allow deserialization of arbitrary classes, which can be exploited to perform unauthorized actions through gadget class deserialization. The affected versions include Spring Framework 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary class instantiation via deserialization, potentially allowing attackers to execute unauthorized actions that compromise confidentiality, integrity, and availability of affected systems. The vulnerability is exploitable remotely without authentication or user interaction but requires an untrusted JMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the affected JMS message converters in untrusted environments or implement strict input validation and deserialization controls to mitigate risk.