CVE-2026-59278

Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka version 4.1.0 Spring for Apache Kafka versions 4.0.0 through 4.0.6 Spring for Apache Kafka versions 3.0.0 through 3.3.16 Spring for Apache Kafka versions 2.9.0 through 2.9.14 Spring for Apache Kafka versions 2.8.12 and earlier

Description JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. This configuration, which is the default for all @KafkaListener consumers, allows an external Kafka producer to inject a java.net.InetAddress type through the spring json header types message header, potentially leading to Server-Side Request Forgery (SSRF) via DNS resolution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.