Skip to content

CVE-2026-59278

In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

6.5 Medium

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.27%Up 0.1 points since Aug 27, 2026

What each source reports

CVE List Score used 6.5

In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Record: CVE-2026-59278
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-66850 6.5

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Record: EUVD-2026-66850
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f6gf-8w3m-3498 6.5

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted...

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Record: GHSA-f6gf-8w3m-3498
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 6.5

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Record: CVE-2026-59278
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 6.5

In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Record: CVE-2026-59278
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1792408723 No score

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 2 CVEs. Fixed in 3.3.16-tuxcare.1.

Record: CLSA-2026-1792408723
Updated: 2026-11-02

Show 10 moreShow less

OSVCLSA-2026-1792411688 No score

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 2 CVEs. Fixed in 2.9.13-tuxcare.2.

Record: CLSA-2026-1792411688
Updated: 2026-11-02

OSVCLSA-2026-1792417151 No score

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 2 CVEs. Fixed in 2.8.11-tuxcare.2.

Record: CLSA-2026-1792417151
Updated: 2026-11-02

OSVCLSA-2026-1792686647 No score

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 2 CVEs. Fixed in 3.3.11-tuxcare.2.

Record: CLSA-2026-1792686647
Updated: 2026-11-02

OSVCLSA-2026-1793720331 No score

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 2 CVEs. Fixed in 3.0.13-tuxcare.3.

Record: CLSA-2026-1793720331
Updated: 2026-11-03

OSVCLSA-2026-1793728180 No score

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 2 CVEs. Fixed in 3.1.10-tuxcare.3.

Record: CLSA-2026-1793728180
Updated: 2026-11-04

OSVCLSA-2026-1793883738 No score

TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 2.8.5-tuxcare.1.

Record: CLSA-2026-1793883738
Updated: 2026-11-06

OSVCLSA-2026-1793883976 No score

TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 2.8.6-tuxcare.1.

Record: CLSA-2026-1793883976
Updated: 2026-11-06

OSVCLSA-2026-1793885501 No score

TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 3.1.5-tuxcare.2.

Record: CLSA-2026-1793885501
Updated: 2026-11-06

OSVCLSA-2026-1793885795 No score

TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 3.2.9-tuxcare.2.

Record: CLSA-2026-1793885795
Updated: 2026-11-06

OSVCLSA-2026-1793887316 No score

TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)

TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 3.2.10-tuxcare.4.

Record: CLSA-2026-1793887316
Updated: 2026-11-06

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 2 CVEs	3.3.16 up to 3.3.16-tuxcare.1	3.3.16-tuxcare.1
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 2 CVEs	2.9.13 up to 2.9.13-tuxcare.2, plus listed versions 2.9.13-tuxcare.1	2.9.13-tuxcare.2
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 2 CVEs	2.8.11 up to 2.8.11-tuxcare.2, plus listed versions 2.8.11-tuxcare.1	2.8.11-tuxcare.2
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 2 CVEs	3.3.11 up to 3.3.11-tuxcare.2, plus listed versions 3.3.11-tuxcare.1	3.3.11-tuxcare.2
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 2 CVEs	3.0.13 up to 3.0.13-tuxcare.3, plus listed versions 3.0.13-tuxcare.13.0.13-tuxcare.2	3.0.13-tuxcare.3
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 2 CVEs	3.1.10 up to 3.1.10-tuxcare.3, plus listed versions 3.1.10-tuxcare.13.1.10-tuxcare.2	3.1.10-tuxcare.3
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 3 CVEs	2.8.5 up to 2.8.5-tuxcare.1	2.8.5-tuxcare.1
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 3 CVEs	2.8.6 up to 2.8.6-tuxcare.1	2.8.6-tuxcare.1
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 3 CVEs	3.1.5 up to 3.1.5-tuxcare.2, plus listed versions 3.1.5-tuxcare.1	3.1.5-tuxcare.2
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 3 CVEs	3.2.9 up to 3.2.9-tuxcare.2, plus listed versions 3.2.9-tuxcare.1	3.2.9-tuxcare.2
`org.springframework.kafka:spring-kafka` TuxCare:Maven From an advisory covering 3 CVEs	3.2.10 up to 3.2.10-tuxcare.4, plus listed versions 3.2.10-tuxcare.13.2.10-tuxcare.23.2.10-tuxcare.3	3.2.10-tuxcare.4

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases	OSV
Nov 6, 2026	affected, facts
Nov 4, 2026	affected, aliases	OSV
Nov 3, 2026	affected, aliases, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59278 is a medium vulnerability (CVSS 6.5) in Spring For Apache Kafka, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. No source names a fixed version.

References