Login Request a demo
SF
Product
Spring for Apache Kafka
by Spring · last CVE Aug 27, 2026
5
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 0High 1Medium 4Low 0
Severity
All severities5Critical0High1Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Spring for Apache Kafka to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-59317
6.5
0%
Aug 27
In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop
Affected: 4.1.0; 4.0.0 through 4.0.6; 3.0.0 through 3.3.16; 2.9.0 through 2.9.14; through 2.8.12
CVE-2026-59278
6.5
0%
Aug 27
In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
Affected: 4.1.0; 4.0.0 through 4.0.6; 3.0.0 through 3.3.16; 2.9.0 through 2.9.14; through 2.8.12
CVE-2026-41727
6.5
0%
Jun 9
In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Affected: 4.0.0 before 4.0.5.1; 3.3.0 before 3.3.15.1; 3.2.0 before 3.2.14; 2.9.0 before 2.9.14; 2.8.0 before 2.8.12
CVE-2026-41726
6.5
0%
Jun 9
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
Affected: 4.0.0 before 4.0.5.1; 3.3.0 before 3.3.15.1; 3.2.0 before 3.2.14; 2.9.0 before 2.9.14; 2.8.0 before 2.8.12
Showing 4