Spring Spring For Apache Kafka vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20265

Newest CVEs

• CVE-2026-59317

  In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

  Spring · Spring for Apache Kafka

  Medium6.5
• CVE-2026-59278

  In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

  Spring · Spring for Apache Kafka

  Medium6.5
• CVE-2026-41731

  In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

  Spring · Spring for Apache Kafka

  High8.1
• CVE-2026-41727

  In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

  Spring · Spring for Apache Kafka

  Medium6.5
• CVE-2026-41726

  In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

  Spring · Spring for Apache Kafka

  Medium6.5
• CVE-2023-34040

  Java Deserialization vulnerability in Spring-Kafka When Improperly Configured

  Spring · Spring For Apache Kafka

  Medium5.3