Spring Spring For Apache Kafka

• CVE-2026-59317 Medium 6.5 In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop 0.4%
• CVE-2026-59278 Medium 6.5 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages 0.3%
• CVE-2026-41731 High 8.1 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization 0.5%
• CVE-2026-41727 Medium 6.5 In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior 0.2%
• CVE-2026-41726 Medium 6.5 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header 0.3%
• CVE-2023-34040 Medium 5.3 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured 2.1%