Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.kafka:spring-kafka

4 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 high, 3 medium
Dependents
23
Registry
Maven Central

Advisories 4

  • In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

    Affected: from 4.0.0, fixed in 4.0.6; from 3.3.0, fixed in 3.3.16; from 3.2.0, through 3.2.13; from 2.9.0, through 2.9.13; through 2.8.11.

  • CVE-2026-41727Medium 6.5

    In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

    Affected: from 4.0.0, fixed in 4.0.6; from 3.3.0, fixed in 3.3.16; from 3.2.0, through 3.2.13; from 2.9.0, through 2.9.13; through 2.8.11.

  • CVE-2026-41726Medium 6.5

    In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

    Affected: from 4.0.0, fixed in 4.0.6; from 3.3.0, fixed in 3.3.16; from 3.2.0, through 3.2.13; from 2.9.0, through 2.9.13; through 2.8.11.

  • CVE-2023-34040Medium 5.3

    Java Deserialization vulnerability in Spring-Kafka When Improperly Configured

    Affected: from 2.8.1, fixed in 2.9.11; from 3.0.0, fixed in 3.0.10.