The vulnerability exists in the JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper components of Spring for Apache Kafka. These components matched type headers against trusted packages using a prefix check, implicitly trusting all subpackages. Combined with Jackson's default bean deserialization, this allows a malicious producer to supply crafted header values that cause the consumer to deserialize arbitrary Java Development Kit (JDK) types. This deserialization flaw (CWE-502) can lead to arbitrary code execution on affected systems. The affected versions include Spring for Apache Kafka 4.0.0 through 4.0.5, 3.3.0 through 3.3.15, 3.2.0 through 3.2.13, 2.9.0 through 2.9.13, and 2.8.0 through 2.8.11. The Red Hat advisory confirms the issue but states that no mitigation or fix currently meets their criteria for deployment.

Successful exploitation allows a remote attacker to execute arbitrary code on the consumer system by supplying crafted Kafka header values that trigger unsafe deserialization of arbitrary JDK types. This compromises confidentiality, integrity, and availability of the affected system, as indicated by the CVSS 3.1 score of 8.1 (high severity). There are no known exploits in the wild at this time.

According to the Red Hat advisory, no official fix or patch is currently available, and existing mitigation options do not meet criteria for ease of use, applicability, or stability. Users should monitor the vendor advisory for updates. Until a fix is released, consider restricting or validating Kafka header inputs where possible and applying any vendor-recommended workarounds once available. Avoid trusting untrusted Kafka producers.