exploitDog

CVE-2026-59278

Опубликовано: 27 авг. 2026

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Ссылки

https://spring.io/security/cve-2026-59278
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

Версия до 2.8.13 (исключая)

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

Версия от 2.9.0 (включая) до 2.9.15 (исключая)

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.3.17 (исключая)

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.0.6.1 (исключая)

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

Версия от 4.1.0 (включая) до 4.1.0.1 (исключая)

EPSS

Процентиль: 18%

0.00266

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-918

Связанные уязвимости

CVE-2026-59278

CVSS3: 6.5

redhat

около 2 месяцев назад

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

GHSA-f6gf-8w3m-3498

CVSS3: 6.5

github

около 2 месяцев назад

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

EPSS

Процентиль: 18%

0.00266

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-918