VMware Spring For Apache Kafka vulnerabilities

6 CVEs affecting VMware Spring For Apache Kafka, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59317, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-34040, published 2023-08-24. High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days. In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have…
CVE-2026-41731, published 2026-06-10. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its…
CVE-2026-59317, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length…
CVE-2026-41727, published 2026-06-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header…
CVE-2026-41726, published 2026-06-10. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values,…
CVE-2026-59278, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener…