CVE-2026-59278 Security Details

CVE ID

CVE-2026-59278

CWE

CWE-918

CVE Description

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Published

Aug 20, 2026

CVSS Score & Severity

6.9Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

EPSS Score

0.266%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/kafka/support/DefaultKafkaHeaderMapper.trusted(Ljava/lang/String;)Z

JVM

org/springframework/kafka/support/JsonKafkaHeaderMapper.trusted(Ljava/lang/String;)Z

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT