CVE-2026-59278

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59278

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59278.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59278

Published

2026-08-27T05:20:36Z

Modified

2026-09-03T03:48:14Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

Details

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Database specific

{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59278.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.0"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.6"
                },
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.3.16"
                },
                {
                    "introduced": "2.9.0"
                },
                {
                    "last_affected": "2.9.14"
                },
                {
                    "last_affected": "2.8.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/spring-projects/spring-kafka

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-kafka

Events

Introduced

a8dba16e18a7ed3c25cc7022ebf2fd1902e735e1

Fixed

6c08403dace1252b5379c7965bed1649e4707e62

Database specific

Show details

{
    "cpe": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.0.1"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59278.json"