org.springframework.kafka:spring-kafka 1.1.0.RELEASE

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.kafka:spring-kafka package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the `spring_json_header_types` message header by the `JsonKafkaHeaderMapper` and `DefaultKafkaHeaderMapper`. An attacker can cause arbitrary DNS resolution requests by injecting a crafted `java.net.InetAddress` type, potentially leading to unauthorized network access or information disclosure. How to fix Deserialization of Untrusted Data? Upgrade `org.springframework.kafka:spring-kafka` to version 4.0.7, 4.1.1 or higher.	[,4.0.7)[4.1.0,4.1.1)
H Improper Check for Unusual or Exceptional Conditions Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the `DeadLetterPublishingRecovererFactory`. An attacker can cause repeated failures and stall partition consumption by attaching a malformed `retry_topic-original-timestamp` header (such as a zero-length byte array) to a Kafka message, which triggers an unhandled exception and results in an infinite recovery loop. How to fix Improper Check for Unusual or Exceptional Conditions? Upgrade `org.springframework.kafka:spring-kafka` to version 4.0.7, 4.1.1 or higher.	[,4.0.7)[4.1.0,4.1.1)
C Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the `JsonKafkaHeaderMapper` or the deprecated `DefaultKafkaHeaderMapper` functions. An attacker can achieve arbitrary code execution by supplying crafted header values that trigger deserialization of untrusted JDK types when processed by the consumer. How to fix Deserialization of Untrusted Data? Upgrade `org.springframework.kafka:spring-kafka` to version 3.3.16, 4.0.6 or higher.	[,3.3.16)[4.0.0-M1,4.0.6)
H Improper Validation of Specified Quantity in Input Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the `retry_topic-attempts` header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts. How to fix Improper Validation of Specified Quantity in Input? Upgrade `org.springframework.kafka:spring-kafka` to version 3.3.16, 4.0.6 or higher.	[,3.3.16)[4.0.0-M1,4.0.6)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `DelegatingDeserializer` function. An attacker can exhaust system memory by sending records with unique, random `spring.kafka.serialization.selector` header values, leading to unbounded cache growth and potential denial of service. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.kafka:spring-kafka` to version 3.3.16, 4.0.6 or higher.	[,3.3.16)[4.0.0-M1,4.0.6)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the spring_json_header_types message header by the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. An attacker can cause arbitrary DNS resolution requests by injecting a crafted java.net.InetAddress type, potentially leading to unauthorized network access or information disclosure.

How to fix Deserialization of Untrusted Data?

Upgrade org.springframework.kafka:spring-kafka to version 4.0.7, 4.1.1 or higher.

[,4.0.7)[4.1.0,4.1.1)

Improper Check for Unusual or Exceptional Conditions

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the DeadLetterPublishingRecovererFactory. An attacker can cause repeated failures and stall partition consumption by attaching a malformed retry_topic-original-timestamp header (such as a zero-length byte array) to a Kafka message, which triggers an unhandled exception and results in an infinite recovery loop.

How to fix Improper Check for Unusual or Exceptional Conditions?

Upgrade org.springframework.kafka:spring-kafka to version 4.0.7, 4.1.1 or higher.

[,4.0.7)[4.1.0,4.1.1)

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonKafkaHeaderMapper or the deprecated DefaultKafkaHeaderMapper functions. An attacker can achieve arbitrary code execution by supplying crafted header values that trigger deserialization of untrusted JDK types when processed by the consumer.

How to fix Deserialization of Untrusted Data?

Upgrade org.springframework.kafka:spring-kafka to version 3.3.16, 4.0.6 or higher.

[,3.3.16)[4.0.0-M1,4.0.6)

Improper Validation of Specified Quantity in Input

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the retry_topic-attempts header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts.

How to fix Improper Validation of Specified Quantity in Input?

Upgrade org.springframework.kafka:spring-kafka to version 3.3.16, 4.0.6 or higher.

[,3.3.16)[4.0.0-M1,4.0.6)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DelegatingDeserializer function. An attacker can exhaust system memory by sending records with unique, random spring.kafka.serialization.selector header values, leading to unbounded cache growth and potential denial of service.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.kafka:spring-kafka to version 3.3.16, 4.0.6 or higher.

[,3.3.16)[4.0.0-M1,4.0.6)

org.springframework.kafka:spring-kafka@1.1.0.RELEASE

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically