Executive brief
Spring for Apache Kafka's header mappers include java.net in their default trusted packages list, allowing an external Kafka producer to inject serialized Java objects. This can lead to remote code execution when messages are processed by the default @KafkaListener configuration, affecting all applications using this framework without explicit security hardening.
Technical details
The vulnerability is an unsafe deserialization flaw in JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper, which include java.net in their default trusted packages list. An unauthenticated external Kafka producer can craft a malicious message with a spring_json_header_types header containing a serialized java.net.InetAddress or related object that triggers code execution upon deserialization. The attack requires network access to the Kafka broker and affects all @KafkaListener consumers using the default configuration. No authentication or special preconditions are required on the Kafka consumer side. Patches are available in updated versions across the 2.8.x, 2.9.x, 3.x, and 4.x release lines.
Affected products
- Spring Spring for Apache Kafka 2.8.12 and earlier, 2.9.0 through 2.9.14, 3.0.0 through 3.3.16, 4.0.0 through 4.0.6, 4.1.0
Timeline
- 2026-08-27: disclosed