Spring for Apache Kafka EUVD-2026-35908

Exploitation requires the attacker to be able to produce messages to a Kafka topic that a vulnerable Spring for Apache Kafka consumer reads, with that consumer configured to use JsonKafkaHeaderMapper or DefaultKafkaHeaderMapper for header type mapping. The consumer must have at least one entry in its trustedPackages list that is a prefix of (or shares a prefix with) an attacker-reachable class, and Jackson default bean deserialization must be in effect (the default for these mappers). Reaching arbitrary code execution further requires exploitable gadget classes on the consumer classpath; without suitable gadgets the impact may degrade to type confusion or denial of service. Limiting factors: closed/internal Kafka clusters where all producers are trusted, ACL-restricted topics, consumers that have replaced the default header mapper with a strict type allowlist, and the AC:H rating in the CVSS vector all reduce realistic exposure.

CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects an unauthenticated, network-reachable attack with high impact across CIA, mitigated by high attack complexity. The complexity rating is appropriate: the attacker must already be able to publish to a topic the victim consumes, and successful code execution depends on exploitable gadgets being present on the consumer classpath - both real but non-trivial preconditions. EPSS, KEV, and SSVC data were not supplied for this CVE, so prioritization must lean on the CVSS vector and the well-known severity of Jackson default-typing deserialization rather than on observed exploitation. No public PoC was identified in the provided references; this should not be treated as zero-day, but the bug pattern is well-understood and gadget chains are widely documented, so weaponization by a motivated attacker is plausible once the advisory text is parsed. Net assessment: high-priority patch for any deployment where Kafka producers and consumers cross trust boundaries (multi-tenant clusters, ingestion from partner systems, internet-exposed brokers); lower urgency where producers are fully controlled and isolated.

An attacker who can publish records to a Kafka topic consumed by a vulnerable Spring application crafts a message header whose declared Java type points to a class in a subpackage of any trusted package (or one matching the prefix), with a JSON value that drives Jackson's default bean deserialization into a gadget chain present on the consumer classpath. When the consumer reads the record, the header mapper accepts the type, Jackson constructs the attacker-chosen object, and side effects of that construction yield arbitrary code execution or sensitive data disclosure in the consumer JVM. No public PoC was identified in the supplied references, but the pattern mirrors prior Jackson default-typing exploits.