Home
HIGH: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDefault status
unaffected
4.0.0 (custom) before 4.0.6
affected
3.3.0 (custom) before 3.3.16
affected
3.2.0 (custom) before 3.2.14
affected
2.9.0 (custom) before 2.9.14
affected
2.8.0 (custom) before 2.8.12
affected
Description
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Problem types
CWE-502: Deserialization of Untrusted Data
Product status
4.0.0 (custom) before 4.0.6
3.3.0 (custom) before 3.3.16
3.2.0 (custom) before 3.2.14
2.9.0 (custom) before 2.9.14
2.8.0 (custom) before 2.8.12
References
spring.io/security/cve-2026-41731