The vulnerability arises from the way Spring for Apache Kafka's JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper validate trusted package headers using a prefix check, which implicitly trusts all subpackages. Combined with Jackson's default bean deserialization, this flaw enables a malicious producer to supply crafted Kafka header values that cause the consumer to deserialize arbitrary Java objects, leading to potential remote code execution or other impacts associated with unsafe deserialization. Affected versions include 2.8.0 through 2.8.11, 2.9.0 through 2.9.13, 3.2.0 through 3.2.13, 3.3.0 through 3.3.15, and 4.0.0 through 4.0.5. The CVSS 3.1 base score is 8.1, indicating high severity. The Red Hat advisory linked does not explicitly state patch availability or remediation steps.

Successful exploitation allows an attacker controlling Kafka message headers to cause the consumer to deserialize arbitrary Java objects, potentially leading to remote code execution, data compromise, or denial of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper or applying custom deserialization validation to avoid processing untrusted data. Monitor the Red Hat advisory and Spring project updates for official patches or mitigations.