This vulnerability arises from the Spring JMS converters that allow Jackson to instantiate arbitrary classes during message deserialization. An attacker sending a crafted JMS message can trigger such instantiation, leading to execution of malicious code in the process and compromising confidentiality, integrity, and availability. The flaw falls under CWE‑502, unsafe deserialization.

Spring Framework versions 5.3.0–5.3.48, 6.1.0–6.1.27, 6.2.0–6.2.18, and 7.0.0–7.0.7 are affected. These versions run in any Java application that uses org.springframework.jms.support.converter.MappingJackson2MessageConverter or the newer JacksonJsonMessageConverter in an environment where JMS messages can come from untrusted sources.

The CVSS score of 8.1 indicates high severity and the lack of an EPSS score makes the actual exploitation probability unclear, but unsafe deserialization makes exploitation practical. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely target systems where the application exposes a publicly reachable JMS broker or accepts messages from external partners. Once abused, arbitrary code may be executed on the application host.