CVE-2026-41731: Spring for Apache Kafka - Overly Broad Trusted-Package Matching Vulnerability
Summary
CVE-2026-41731: JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Affects org.springframework.kafka:spring-kafka across 5 version ranges.
< 2.8.11
>= 2.9.0, <= 2.9.13
>= 3.2.0, <= 3.2.13
>= 3.3.0, < 3.3.16
>= 4.0.0, < 4.0.6
Fixed in 2.8.11, 3.3.16 or 4.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring for Apache Kafka is a framework that simplifies the integration of Spring applications with Apache Kafka, a distributed streaming platform. It provides features such as message production and consumption, configuration management, and error handling. However, it has a vulnerability that allows for overly broad trusted-package matching in header mappers, which can lead to serious security risks.
Vulnerability Detail
The vulnerability arises from the JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper, which match type headers against trusted packages using a prefix check. This means that if a package is trusted, all of its subpackages are implicitly trusted as well. This can lead to a situation where a producer can supply crafted header values that cause the consumer to deserialize arbitrary JDK types, potentially leading to remote code execution or other malicious activities.
How To Fix
Latest published version: 4.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.8.112.8.11 -
>= 3.3.0, < 3.3.163.3.16 -
>= 4.0.0, < 4.0.64.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the header mappers or implement custom header mappers that do not allow for broad package matching. This can help mitigate the risk until you can upgrade to a patched version.
Conclusion
CVE-2026-41731 is a significant vulnerability in Spring for Apache Kafka that can lead to serious security risks due to overly broad trusted-package matching. It is crucial to update to the patched versions as soon as possible to mitigate these risks.
See every vulnerability recorded for org.springframework.kafka:spring-kafka →
FAQ
CVE-2026-41731 is a vulnerability in Spring for Apache Kafka that allows for overly broad trusted-package matching in header mappers, leading to potential deserialization of arbitrary JDK types.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's pom.xml file using the Vulert playground without any signup.
The vulnerability can lead to remote code execution, data breaches, and other malicious activities due to the deserialization of arbitrary JDK types.
If you cannot upgrade immediately, consider implementing custom header mappers that restrict broad package matching as a temporary workaround.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.kafka:spring-kafka.
