CVE-2026-41731High· 8.1▾ TwilightIn Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.5%
0.5% → 0.6%
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
org.springframework.kafka:spring-kafka >= 4.0.0, <= 4.0.5org.springframework.kafka:spring-kafka >= 3.3.0, <= 3.3.15org.springframework.kafka:spring-kafka >= 3.2.0, <= 3.2.13org.springframework.kafka:spring-kafka >= 2.9.0, <= 2.9.13org.springframework.kafka:spring-kafka <= 2.8.11Upgrade to a patched release:
org.springframework.kafka:spring-kafka 4.0.6org.springframework.kafka:spring-kafka 3.3.16Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41726Medium· 6.5In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
CVE-2026-41855High· 8.1In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…
CVE-2025-15438Medium· 4.7A vulnerability was determined in PluXml up to 5.8.22
CVE-2025-26399Critical· 9.8SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine
CVE-2025-12305Medium· 6.3A vulnerability was found in quequnlong shiyi-blog up to 1.2.1
CVE-2026-47892Critical· 9.8Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints