Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by vmware

CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

High 8.1

In plain English

A high-severity unsafe deserialization in Spring for Apache Kafka from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.kafka:spring-kafka4.0.6GHSA-xq69-5h5v-x9x4
Mavenorg.springframework.kafka:spring-kafka3.3.16GHSA-xq69-5h5v-x9x4
Mavenorg.springframework.kafka:spring-kafkano fix listedGHSA-xq69-5h5v-x9x4
Mavenorg.springframework.kafka:spring-kafkano fix listedGHSA-xq69-5h5v-x9x4
Mavenorg.springframework.kafka:spring-kafkano fix listedGHSA-xq69-5h5v-x9x4

Affected products (as reported)

VendorProductVersions
Spring Spring for Apache Kafka 4.0.0 – before 4.0.5.13.3.0 – before 3.3.15.13.2.0 – before 3.2.142.9.0 – before 2.9.142.8.0 – before 2.8.12

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References