CVE-2026-59278: CWE-918 Server-Side Request Forgery (SSRF) in Spring Spring for Apache Kafka

Spring for Apache Kafka's JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper components include java.net in their default trusted packages list. When these mappers are used, which is the default for all @KafkaListener consumers, an external Kafka producer can exploit this by injecting a java.net.InetAddress object via the spring_json_header_types message header. This can lead to Server-Side Request Forgery (SSRF) attacks. The vulnerability affects multiple versions ranging from 2.8.12 and earlier up to 4.1.0. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker controlling an external Kafka producer can inject a java.net.InetAddress type via message headers, potentially enabling SSRF attacks. This could allow the attacker to make the server perform unintended network requests, possibly leading to information disclosure or other impacts related to SSRF. The CVSS score of 6.5 reflects a medium impact with low complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider reviewing and restricting the trusted packages list in JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper configurations to exclude java.net or disable deserialization of untrusted types in message headers. Avoid using default configurations that trust java.net packages if possible.