Spring For Apache Kafka vulnerabilities

CVE-2026-41731 [HIGH] CWE-502 CVE-2026-41731: JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trust JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize ar

CVE-2023-34040 [HIGH] CWE-502 CVE-2023-34040: In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserializa In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of

CVE-2026-41726 [MEDIUM] CWE-770 CVE-2026-41726: When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap withou When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.

CVE-2026-59278 [MEDIUM] CWE-918 CVE-2026-59278: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted package JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.

CVE-2026-59317 [MEDIUM] CWE-1284 CVE-2026-59317: DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafk

CVE-2026-41727 [MEDIUM] CWE-20 CVE-2026-41727: Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header value Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Affected versions: