| CVE-2026-59317 |
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord…
|
6.5
Medium
|
Aug 27, 2026 |
| CVE-2026-59278 |
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list
|
6.5
Medium
|
Aug 27, 2026 |
| CVE-2026-41731 |
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using…
|
8.1
High
|
Jun 9, 2026 |
| CVE-2026-41727 |
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on…
|
6.5
Medium
|
Jun 9, 2026 |
| CVE-2026-41726 |
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending…
|
6.5
Medium
|
Jun 9, 2026 |
| CVE-2023-34040 |
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector…
|
5.3
Medium
|
Aug 24, 2023 |