org.springframework.kafka:spring-kafka 3.3.15

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.kafka:spring-kafka package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the `JsonKafkaHeaderMapper` or the deprecated `DefaultKafkaHeaderMapper` functions. An attacker can achieve arbitrary code execution by supplying crafted header values that trigger deserialization of untrusted JDK types when processed by the consumer. How to fix Deserialization of Untrusted Data? Upgrade `org.springframework.kafka:spring-kafka` to version 3.3.16, 4.0.6 or higher.	[,3.3.16)[4.0.0-M1,4.0.6)
H Improper Validation of Specified Quantity in Input Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the `retry_topic-attempts` header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts. How to fix Improper Validation of Specified Quantity in Input? Upgrade `org.springframework.kafka:spring-kafka` to version 3.3.16, 4.0.6 or higher.	[,3.3.16)[4.0.0-M1,4.0.6)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `DelegatingDeserializer` function. An attacker can exhaust system memory by sending records with unique, random `spring.kafka.serialization.selector` header values, leading to unbounded cache growth and potential denial of service. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework.kafka:spring-kafka` to version 3.3.16, 4.0.6 or higher.	[,3.3.16)[4.0.0-M1,4.0.6)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonKafkaHeaderMapper or the deprecated DefaultKafkaHeaderMapper functions. An attacker can achieve arbitrary code execution by supplying crafted header values that trigger deserialization of untrusted JDK types when processed by the consumer.

How to fix Deserialization of Untrusted Data?

Upgrade org.springframework.kafka:spring-kafka to version 3.3.16, 4.0.6 or higher.

[,3.3.16)[4.0.0-M1,4.0.6)

Improper Validation of Specified Quantity in Input

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the retry_topic-attempts header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts.

How to fix Improper Validation of Specified Quantity in Input?

Upgrade org.springframework.kafka:spring-kafka to version 3.3.16, 4.0.6 or higher.

[,3.3.16)[4.0.0-M1,4.0.6)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DelegatingDeserializer function. An attacker can exhaust system memory by sending records with unique, random spring.kafka.serialization.selector header values, leading to unbounded cache growth and potential denial of service.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework.kafka:spring-kafka to version 3.3.16, 4.0.6 or higher.

[,3.3.16)[4.0.0-M1,4.0.6)

org.springframework.kafka:spring-kafka@3.3.15

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically