Executive brief
Spring for Apache Kafka contains a vulnerability in how it handles message headers during data processing. A malicious actor could send specially crafted messages that force the system to run unintended code, potentially leading to full system compromise or unauthorized data access. This affects applications using Spring to integrate with Kafka message brokers.
Technical details
A deserialization vulnerability exists in Spring for Apache Kafka's JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper. The root cause is a prefix-based check for trusted packages in header mappers, which inadvertently trusts all subpackages if a parent package is trusted. When combined with Jackson's default bean deserialization, a remote attacker can provide crafted header values in a Kafka message to trigger the deserialization of arbitrary JDK types. This can lead to remote code execution (RCE) depending on the available gadgets on the classpath. Users should upgrade to versions 4.0.6, 3.3.16, or later.
Affected products
- Spring spring-kafka 4.0.0 to 4.0.5, 3.3.0 to 3.3.15, 3.2.0 to 3.2.13, 2.9.0 to 2.9.13, <= 2.8.11
Timeline
- 2026-06-10: advisory: Initial advisory published
- 2026-06-12: other: Advisory updated and reviewed