Spring For Apache Kafka (Vmware) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 309 known versions, newest CVE from 2026-08-27. Vendor: Vmware.

CVEs of Spring For Apache Kafka

• CVE-2026-59317 - CVSS 6.5 (medium), 2026-08-27: DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new…
• CVE-2026-59278 - CVSS 6.5 (medium), 2026-08-27: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default…
• CVE-2026-41726 - CVSS 6.5 (medium), 2026-06-10: When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random…
• CVE-2026-41731 - CVSS 8.1 (high), 2026-06-10: JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting…
• CVE-2026-41727 - CVSS 6.5 (medium), 2026-06-10: Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record…
• CVE-2023-34040 - CVSS 7.8 (high), 2023-08-24: In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual…