Spring Spring For Apache Kafka
6 CVEs affecting Spring Spring For Apache Kafka. Latest disclosed: 2026-08-27. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41731 | High | 8.1 | 2026-06-10 | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any… |
CVE-2026-59317 | Medium | 6.5 | 2026-08-27 | DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Bi… |
CVE-2026-59278 | Medium | 6.5 | 2026-08-27 | JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default… |
CVE-2026-41727 | Medium | 6.5 | 2026-06-10 | Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record wit… |
CVE-2026-41726 | Medium | 6.5 | 2026-06-10 | When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka… |
CVE-2023-34040 | Medium | 5.3 | 2023-08-24 | In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configurati… |