Threats Tagged 'ghsa-f6gf-8w3m-3498'

CVE-2026-59278 is a Server-Side Request Forgery (SSRF) vulnerability in Spring for Apache Kafka. The issue arises because JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. This default configuration allows an external Kafka producer to inject a java.net.InetAddress type via the spring_json_header_types message header. The vulnerability affects multiple versions of Spring for Apache Kafka, including 4.1.0, 4.0.0 through 4.0.6, 3.0.0 through 3.3.16, 2.9.0 through 2.9.14, and 2.8.12 and earlier. The CVSS score is 6.5, indicating a medium severity level.