Bug 2524842 (CVE-2026-59278) - CVE-2026-59278 org.springframework.kafka/spring-kafka: Spring for Apache Kafka: Server-Side Request Forgery via untrusted Java types in header mappers
Summary: CVE-2026-59278 org.springframework.kafka/spring-kafka: Spring for Apache Kafk...
Keywords:
Status: NEW
Alias: CVE-2026-59278
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-27 06:22 UTC by OSIDB Bzimport
Modified: 2026-09-25 17:03 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-27 06:22:10 UTC 
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
Note You need to log in before you can comment on or make changes to this bug.