HIGH | JUNE 09, 2026 | CVE-2026-41731
Description
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types, including classes whose constructors carry side effects such as allocating file descriptors or spawning thread pools.
Affected Spring Products and Versions
Spring for Apache Kafka:
- 4.0.0 - 4.0.5
- 3.3.0 - 3.3.15
- 3.2.0 - 3.2.13
- 2.9.0 - 2.9.13
- 2.8.0 - 2.8.11
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 4.0.x | 4.0.6 | OSS |
| 4.0.5.1 | Commercial | |
| 3.3.x | 3.3.16 | OSS |
| 3.3.15.1 | Commercial | |
| 3.2.x | 3.2.14 | Commercial |
| 2.9.x | 2.9.14 | Commercial |
| 2.8.x | 2.8.12 | Commercial |
No further mitigation steps are necessary.
Credit
This issue was discovered internally.
References
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy