CVE-2026-41731: In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41731?
The severity of CVE-2026-41731 is rated high with a score of 8.1.
What does CVE-2026-41731 involve?
CVE-2026-41731 involves overly broad trusted-package matching in header mappers in Spring for Apache Kafka, which can expose JDK classes to deserialization attacks.
How can I mitigate the risks associated with CVE-2026-41731?
To mitigate CVE-2026-41731, update to the latest version of Spring for Apache Kafka that addresses this vulnerability.
What impact does CVE-2026-41731 have on application security?
CVE-2026-41731 can lead to deserialization of untrusted data, potentially allowing an attacker to execute arbitrary code.
Which versions of Spring for Apache Kafka are affected by CVE-2026-41731?
CVE-2026-41731 affects versions of Spring for Apache Kafka that utilize the JsonKafkaHeaderMapper and deprecated DefaultKafkaHeaderMapper.