Skip to contentSpring For Apache Kafka vulnerabilities
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopCVE-2026-59317Fix available6.5 Medium
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packagesCVE-2026-592786.5 Medium
- spring for apache kafka, vmware spring for apache kafka, red hat fuse 7 +2 more +4 moreIn Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationCVE-2026-41731Fix available8.1 High
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorCVE-2026-41727Fix available6.5 Medium
- spring for apache kafka, vmware spring for apache kafka +1 moreIn Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerCVE-2026-41726Fix available6.5 Medium
- spring for apache kafka, vmware spring for apache kafka +1 moreJava Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredCVE-2023-34040Public exploitFix available5.3 Medium