Description

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T06:17:22.403Z",
  "pubdate": "2026-08-27T06:17:22.403Z",
  "executiveSummary": "A deserialization vulnerability exists within Spring for Apache Kafka involving the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. The vulnerability stems from an insecure default configuration that includes 'java.net' in the list of trusted packages for header deserialization.\nThis flaw permits an unauthorized external Kafka producer to inject arbitrary types, specifically 'java.net.InetAddress', via the 'spring_json_header_types' message header. Successful exploitation allows an attacker to trigger unintended object instantiation or side effects during the deserialization process.\nThe vulnerability affects Spring for Apache Kafka versions 4.1.0, 4.0.0 - 4.0.6, 3.0.0 - 3.3.16, 2.9.0 - 2.9.14, and 2.8.12 and earlier. Because these mappers are utilized by default in @KafkaListener consumers, the impact is widespread across Spring Kafka applications.\nThe primary risk involves potential Remote Code Execution (RCE) or denial-of-service, depending on the side effects triggered by the deserialization of the malicious header object. No specific authentication is required if an attacker can reach the Kafka broker and inject messages into a consumed topic.",
  "technicalDetails": "The vulnerability resides in the way 'JsonKafkaHeaderMapper' and 'DefaultKafkaHeaderMapper' handle the deserialization of Kafka message headers. These components facilitate the mapping of JSON-serialized headers back into Java objects based on the 'spring_json_header_types' header metadata.\nThe root cause is an overly permissive default configuration regarding trusted deserialization classes. By including 'java.net' in the allow-list, the mapper implicitly trusts classes within the 'java.net' package to be instantiated upon header processing. An attacker can leverage this by crafting a malicious Kafka message containing a 'spring_json_header_types' header that specifies the 'java.net.InetAddress' type.\nThe attack flow proceeds as follows: First, the attacker identifies a target Kafka consumer utilizing the vulnerable header mappers. Second, the attacker crafts a malicious payload containing serialized object data and sets the 'spring_json_header_types' header to include 'java.net.InetAddress'. Third, the attacker publishes this message to the Kafka topic monitored by the target application. Upon consumption, the 'KafkaListener' automatically invokes the mapper to deserialize the header. The mapper, observing that 'java.net' is a trusted package, proceeds to instantiate or perform lookups using the provided malicious data.\nThe primary vector for exploitation is the instantiation of the 'java.net.InetAddress' class, which can trigger network-related side effects such as DNS resolution. In certain environments, this behavior can be chained with other deserialization gadgets present in the classpath to achieve code execution or facilitate server-side request forgery (SSRF). Because this behavior is inherent to the default configuration of '@KafkaListener', no complex setup is required by the victim, making the application vulnerable out-of-the-box if the Kafka topic is accessible to untrusted producers.\nThe scope of impact is governed by the specific gadgets available in the application's classpath. If an attacker can successfully control the parameters passed to the deserializer, they can influence the internal state of the application or trigger network activity from the host machine, potentially bypassing network segmentation or interacting with internal services. The lack of strict validation for the 'spring_json_header_types' header provides the entry point for this type-confusion attack."
}