← Back

CVE-2026-59278

nvd nist
Published: Aug 27, 2026Modified: Sep 1, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: security@vmware.com (Secondary)

Description

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Affected (5)

Vmware
1 product
Spring For Apache Kafka
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring For Apache Kafka
Before 2.8.13
Spring For Apache Kafka
From 2.9.0 to 2.9.15
Spring For Apache Kafka
From 3.0.0 to 3.3.17
Spring For Apache Kafka
From 4.0.0 to 4.0.6.1
Spring For Apache Kafka
From 4.1.0 to 4.1.0.1

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.