CVE-2026-59278: In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the springjsonheadertypes message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring for Apache Kafkato a version that resolves this vulnerability.Fixed in 2.8.12 - Upgrade
Upgrade
Spring for Apache Kafkato a version that resolves this vulnerability.Fixed in 2.9.14 - Upgrade
Upgrade
Spring for Apache Kafkato a version that resolves this vulnerability.Fixed in 4.0.6 - Upgrade
Upgrade
Spring for Apache Kafkato a version that resolves this vulnerability.Fixed in 4.1.0 - Configuration
Configure the Kafka header mapper used by @KafkaListener consumers so that java.net is not present in its default trusted packages list; this prevents injection of java.net.InetAddress via the spring_json_header_types message header.
Spring for Apache Kafka header mappers (JsonKafkaHeaderMapper/DefaultKafkaHeaderMapper) default trusted packages list = Remove java.net from the default trusted packages list
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
All @KafkaListener consumers using the default header-mapper configuration are affected, because JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper are used by default. The affected versions are 4.1.0, 4.0.0 through 4.0.6, 3.0.0 through 3.3.16, 2.9.0 through 2.9.14, and 2.8.12 and earlier.
What does an attacker need to exploit it?
An attacker needs to be able to act as an external Kafka producer and send a message to the consumer. They can inject a java.net.InetAddress type through the spring_json_header_types message header, triggering DNS resolution.
How can I determine whether a consumer is affected?
Check whether the application uses an affected Spring for Apache Kafka version and has @KafkaListener consumers using the default JsonKafkaHeaderMapper or DefaultKafkaHeaderMapper configuration. Messages carrying spring_json_header_types that declare a java.net.InetAddress type are the relevant exploitation indicator.