Skip to content
OpenAdvisories

Product · Spring

Spring for Apache Kafka

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-41731

    In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

    JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserializa…

    Spring Spring for Apache Kafka org.springframework.kafka:spring-kafka Maven