Spring for Apache Kafka vulnerabilities

2 known vulnerabilities in Spring for Apache Kafka from Spring. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Spring for Apache Kafka: Deserialization of Untrusted Data

  CVE-2026-41731Jun 10, 2026Spring

  JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserializat

• 7.8 High severity

  Spring For Apache Kafka: Deserialization of Untrusted Data

  CVE-2023-34040Aug 24, 2023SpringEPSS 2.09%

  In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deser