AIKIDO-2026-11171
spring-kafka is vulnerable to Deserialization of Untrusted Data
81
High Risk
This Affects:
spring-kafkaTL;DR
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types, including classes whose constructors carry side effects such as allocating file descriptors or spawning thread pools.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-kafka is vulnerable to Deserialization of Untrusted Data in versions 0.0.1 - 2.8.11, 2.9.0 - 2.9.13, 3.0.0 - 3.2.13, 3.3.0 - 3.3.15 and 4.0.0 - 4.0.5.
How to fix this
Upgrade the org.springframework.kafka:spring-kafka library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant