CVE-2026-59278 Server-side request forgery in Spring for Apache Kafka

What is CVE-2026-59278?

CVE-2026-59278 is a medium-severity server-side request forgery vulnerability in Spring for Apache Kafka, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Weakness: CWE-918

Which versions are affected by CVE-2026-59278?

It affects 1 product.

Products include Vmware Spring for Apache Kafka.

How do I fix CVE-2026-59278?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-59278 being exploited?

There is no known exploitation of CVE-2026-59278 in the wild and no public exploit code.

Other vulnerabilities in Spring for Apache Kafka

• CVE-2026-59317 Denial of service in Spring for Apache Kafka Medium 6.5
• CVE-2026-41726 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header Medium 6.5
• CVE-2026-41727 In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior Medium 6.5
• CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f6gf-8w3m-3498.