JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. This configuration, which is the default for all @KafkaListener consumers, allows an external Kafka producer to inject a `java.net.InetAddress` type through the `spring json header types` message header, potentially leading to Server-Side Request Forgery (SSRF) via DNS resolution.