Multiple Security Flaws Addressed in Core Java Application Subsystems

This advisory details multiple critical vulnerabilities in Spring GraphQL and related integration modules that can enable remote code execution via unsafe deserialization, cross-site WebSocket/session hijacking, arbitrary class loading through crafted Kafka/Pulsar headers, and path traversal in synchronization components. Administrators are strongly advised to apply the listed maintenance updates (e.g., Kafka 4.0.6 / 3.3.16, Pulsar 2.0.6 / 1.2.18, synchronizer 7.0.5) immediately to mitigate exploitation risk.