Spring / Spring for Apache Kafka
5 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-59317 | In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop | MEDIUM | 6.5 | Aug 27, 2026 |
| CVE-2026-59278 | In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages | MEDIUM | 6.5 | Aug 27, 2026 |
| CVE-2026-41731 | In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization | HIGH | 8.1 | Jun 9, 2026 |
| CVE-2026-41727 | In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior | MEDIUM | 6.5 | Jun 9, 2026 |
| CVE-2026-41726 | In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header | MEDIUM | 6.5 | Jun 9, 2026 |
| CVE-2023-34040 | Java Deserialization vulnerability in Spring-Kafka When Improperly Configured | HIGH | 7.8 | Aug 24, 2023 |
Showing 1 to 5 of 5 CVEs