Deserialization of Untrusted Data in Spring for Apache Kafka - CVE-2026-41731
Published: August 31, 2026
Vulnerability identifier: #VU146403
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41731
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause resource exhaustion and other side effects by triggering deserialization of arbitrary JDK types.
The vulnerability exists due to improper control of deserialization in JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper when processing type headers against trusted packages. A remote attacker can supply crafted header values to cause resource exhaustion and other side effects by triggering deserialization of arbitrary JDK types.
The issue stems from trusted-package matching that used a prefix check, so trusting a package also trusted its subpackages.
Affected software
Spring for Apache Kafka
How to mitigate CVE-2026-41731
Install security update from vendor's website.
Spring for Apache Kafka - addressed in versions 2.8.12, 2.9.14, 3.2.14, 3.3.15.1, 3.3.16, 4.0.5.1, 4.0.6