CVE-2023-34040

CVE-2023-34040 affects VMware Tanzu Spring for Apache Kafka (versions 3.0.9 and earlier; 2.9.10 and earlier). The issue is a deserialization attack via specially crafted DeserializationException headers in messages when an application does not use an ErrorHandlingDeserializer for keys/values and ...

CVE-2026-41731

Spring for Apache Kafka vulnerable due to overly broad trusted-package matching in JsonKafkaHeaderMapper and deprecated DefaultKafkaHeaderMapper: they compare type headers against trusted packages with a prefix check, causing any trusted package to implicitly trust all subpackages. When combined ...

CVE-2026-41726

In Spring for Apache Kafka, CVE-2026-41726 arises when an application uses the DelegatingDeserializer and an attacker can send records with unique, random spring.kafka.serialization.selector header values. This can cause the consumer’s heap to grow without bound, leading to garbage-collection thr...

CVE-2026-41727

Summary: Spring for Apache Kafka’s retry topic infrastructure does not adequately validate user-controlled header values, allowing a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify a message’s position in the retry sequen...