CVE-2026-59278
In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
| Vendor | spring |
| Product | spring for apache kafka |
| Ecosystems | |
| Industries | TechnologyEnterprise |
| Published | Aug 27, 2026 |
| Last Updated | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for spring spring for apache kafka
Be the first to know when new medium vulnerabilities affecting spring spring for apache kafka are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Spring / Spring for Apache Kafka
4.1.0 4.0.0 ≤ 4.0.6 3.0.0 ≤ 3.3.16 2.9.0 ≤ 2.9.14 0 ≤ 2.8.12