← Vulnerability feed

Vulnerability record · CVE-2026-41731 · published 10 June 2026

CVE-2026-41731: Vmware spring for apache kafka deserialization of untrusted data vulnerability

Vmware · Spring For Apache Kafka

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

8.1 CVSS 3.1 High EPSS 0.65% · top 51.1% CWE-502 · Deserialization of untrusted data
8.1CVSS 3.1 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
4References
5 Aug 2026Last modified by NVD

Description

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://spring.io/security/cve-2026-41731 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-41731 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487375 Issue TrackingThird Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41731.json Third Party Advisory

Track CVE-2026-41731 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-4437Apache Shiro hardcoded remember-me cipher key enables code executionApache Shiro before 1.2.5 uses a default cipher key for the "remember me" feature when no key is configured, allowing attackers to forge or decrypt r…KEVEPSS 93%analysed9.8CVE-2015-1427Elasticsearch Groovy scripting engine sandbox escape RCEThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 fails to enforce its sandbox, letting a crafted script execute arbit…KEVEPSS 100%analysed8.1CVE-2017-12617Apache Tomcat Default Servlet JSP upload leads to remote code executionApache Tomcat with HTTP PUT enabled (for example, the Default servlet readonly parameter set to false) allows an attacker to upload a JSP file throug…KEVEPSS 100%analysed9.8CVE-2018-1270Spring Framework STOMP over WebSocket broker remote code executionSpring Framework versions 5.0 before 5.0.5 and 4.3 before 4.3.15 (plus older unsupported versions) allow applications to expose STOMP over WebSocket …EPSS 77%analysed9.8CVE-2017-5645Apache Log4j 2 socket server deserialization allows remote code executionApache Log4j 2.x before 2.8.2 deserializes binary log events received over its TCP or UDP socket server without validating the payload. A crafted ser…EPSS 90%analysed9.6CVE-2025-12543Redhat build of apache camel improper input validation vulnerabilityA flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to pr…EPSS 1.4%9.1CVE-2026-28369Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly proce…EPSS 0.89%9.1CVE-2026-28367Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for…EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2026-41731), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.