CVE-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36...

Spring-Kafka-POC-CVE-2023-34040

Spring Kafka Deserialization POC Requirements Java 11 Maven Docker or Kafka Usage First start up the Dockerized Kafka instance. This will start up Kafka and make it available on port 29092. docker-compose up Start up the Consumer application. cd spring-kafka-consumer mvn clean install mvn...

cve-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36...

CVE-2023-34040

CVE-2023-34040 This PoC is cloned from https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 About our analyzing process, please visit PDF file on the main repo...

ROOT-APP-MAVEN-CVE-2026-41731 CVE-2026-41731 in org.springframework.kafka:spring-kafka - Patched by Root

Root has patched CVE-2026-41731 in the org.springframework.kafka:spring-kafka package for Root:Maven. Multiple fixed versions available...

CVE-2026-59317

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

be.appify.prefab:prefab-annotation-processor (>=0.11.0, <=0.12.0), ch.admin.bit.jeap:jeap-audit-command-builder (>=8.8.0, <=10.16.0) +157 more potentially affected by CVE-2026-59317 via org.springframework.kafka:spring-kafka (4.1.0)

org.springframework.kafka:spring-kafka MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - be.appify.prefab:prefab-annotation-processor =0.11.0, =8.8.0, =8.8.0, =15.7.0,...

CVE-2026-59317 In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

CVE-2026-59317 In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

EUVD-2026-67199

DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +206 more potentially affected by CVE-2026-59317 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.6)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =1.5.0,...

be.appify.prefab:prefab-annotation-processor (>=0.11.0, <=0.12.0), ch.admin.bit.jeap:jeap-audit-command-builder (>=8.8.0, <=10.16.0) +157 more potentially affected by CVE-2026-59278 via org.springframework.kafka:spring-kafka (4.1.0)

org.springframework.kafka:spring-kafka MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - be.appify.prefab:prefab-annotation-processor =0.11.0, =8.8.0, =8.8.0, =15.7.0,...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

EUVD-2026-66850

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

PT-2026-82721

DeadLetterPublishingRecovererFactory reads the retry topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

PT-2026-82417

Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka version 4.1.0 Spring for Apache Kafka versions 4.0.0 through 4.0.6 Spring for Apache Kafka versions 3.0.0 through 3.3.16 Spring for Apache Kafka versions 2.9.0 through 2.9.14 Spring for Apache Kafka versions 2.8.12 and...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +208 more potentially affected by CVE-2026-59278 via org.springframework.kafka:spring-kafka (>=4.0.0-m2, <=4.0.6)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0-m2, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =1.5....

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the springjsonheadertypes message header by the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. An attacker can cause arbitrary DNS resolution requests by injecting a craft...

be.appify.prefab:prefab-annotation-processor (>=0.11.0, <=0.12.0), ch.admin.bit.jeap:jeap-audit-command-builder (>=8.8.0, <=10.16.0) +157 more potentially affected by CVE-2026-59317 via org.springframework.kafka:spring-kafka (4.1.0)

org.springframework.kafka:spring-kafka MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - be.appify.prefab:prefab-annotation-processor =0.11.0, =8.8.0, =8.8.0, =15.7.0,...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the DeadLetterPublishingRecovererFactory. An attacker can cause repeated failures and stall partition consumption by attaching a malformed retrytopic-original-timestamp header suc...