CVE-2026-59278: Spring Kafka Header Injection Vulnerability

CVE-2026-59278 Overview

CVE-2026-59278 affects Spring for Apache Kafka header mappers that include java.net in their default trusted packages list. The JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper classes accept java.net.InetAddress types via the spring_json_header_types message header. Because these mappers are the default configuration for all @KafkaListener consumers, an external Kafka producer can inject untrusted java.net objects into consumer applications. The flaw enables unintended deserialization behavior in downstream message processing.

Critical Impact
External Kafka producers can inject java.net.InetAddress objects into @KafkaListener consumers, triggering DNS lookups and potential information disclosure through the default header mapper configuration.

Affected Products

Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 through 4.0.6 and 3.0.0 through 3.3.16
Spring for Apache Kafka 2.9.0 through 2.9.14 and 2.8.12 and earlier

Discovery Timeline

2026-08-27 - CVE-2026-59278 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-59278

Vulnerability Analysis

The vulnerability resides in Spring for Apache Kafka's default header mapping implementation. Both JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper ship with java.net on the trusted packages allow-list. This mapper handles the spring_json_header_types header, which instructs the consumer how to deserialize inbound header values into Java types. When java.net is trusted, a producer can declare header values of type java.net.InetAddress, causing the consumer to instantiate network address objects from attacker-controlled input.

Instantiation of java.net.InetAddress triggers hostname resolution. An attacker controlling producer output can force the consumer to perform outbound DNS queries against attacker-chosen names. This creates conditions for information disclosure, blind out-of-band exfiltration, and internal network reconnaissance. The attack requires no authentication at the consumer side beyond the ability to publish to a topic the consumer reads.

Root Cause

The root cause is an overly permissive default trusted packages list. Including java.net allows classes with side effects during construction, such as InetAddress, to be materialized from producer-supplied type hints. This is a configuration and design flaw [CWE-502] related to insecure deserialization of untrusted data.

Attack Vector

The attack vector is network-based and unauthenticated relative to the vulnerable component. An external or compromised Kafka producer publishes a message with a crafted spring_json_header_types header referencing java.net.InetAddress. Any downstream @KafkaListener consumer using default header mapper settings deserializes the value, triggering DNS resolution and enabling data exfiltration through DNS side channels. See the Spring Security advisory for CVE-2026-59278 for technical details.

Detection Methods for CVE-2026-59278

Indicators of Compromise

Kafka messages containing spring_json_header_types headers referencing java.net.InetAddress or other java.net classes
Unexpected outbound DNS queries originating from Java Virtual Machine (JVM) processes hosting @KafkaListener consumers
DNS lookups to attacker-controlled or unusual external domains correlated with Kafka consumer activity

Detection Strategies

Inspect Kafka message headers at the broker or through an interceptor and alert on any spring_json_header_types value naming a java.net type
Correlate consumer application logs with DNS resolver logs to identify resolution attempts triggered by inbound Kafka traffic
Audit application dependencies for vulnerable Spring for Apache Kafka versions using software composition analysis

Monitoring Recommendations

Forward JVM DNS resolution telemetry and Kafka broker logs to a centralized data lake for correlation
Baseline normal DNS behavior of Kafka consumer services and alert on deviations
Monitor for exceptions and warnings emitted by DefaultKafkaHeaderMapper and JsonKafkaHeaderMapper during header conversion

How to Mitigate CVE-2026-59278

Immediate Actions Required

Upgrade Spring for Apache Kafka to a fixed version listed in the Spring Security advisory
Restrict the trusted packages list on DefaultKafkaHeaderMapper and JsonKafkaHeaderMapper to only the application-specific packages required
Validate producer identity and message provenance for all topics consumed by @KafkaListener endpoints

Patch Information

Refer to the Spring Security advisory for CVE-2026-59278 for the fixed release versions across the 2.8.x, 2.9.x, 3.x, 4.0.x, and 4.1.x branches. Apply the vendor-supplied upgrade to the appropriate branch matching your deployment.

Workarounds

Explicitly configure the header mapper with a narrow trusted packages list that excludes java.net and other packages with side-effect-bearing constructors
Apply network egress controls to Kafka consumer hosts to block outbound DNS to untrusted resolvers
Enforce authentication and access control lists on Kafka topics to limit which producers can publish to consumed topics

bash

# Configuration example - restrict trusted packages in Spring Kafka
# application.yaml
spring:
  kafka:
    consumer:
      properties:
        spring.json.trusted.packages: "com.example.myapp.events"