How severe is CVE-2026-59278?

CVE-2026-59278 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-59278 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-59278?

CVE-2026-59278 affects Vmware Spring For Apache Kafka. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-59278?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-59278 published?

CVE-2026-59278 was published on 2026-08-27 and last updated on 2026-09-01.

CVE-2026-59278

CVE-2026-59278 is a medium-severity vulnerability in Vmware Spring For Apache Kafka with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-918
Affected product: Vmware Spring For Apache Kafka
Published: 2026-08-27
Last modified: 2026-09-01

Description

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Frequently asked questions

What is CVE-2026-59278?: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
How severe is CVE-2026-59278?: CVE-2026-59278 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-59278 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-59278?: CVE-2026-59278 affects Vmware Spring For Apache Kafka. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-59278?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-59278 published?: CVE-2026-59278 was published on 2026-08-27 and last updated on 2026-09-01.

References

https://spring.io/security/cve-2026-59278

Affected products (1)

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

More vulnerabilities in Vmware Spring For Apache Kafka

CVE-2026-41731 — High (CVSS 8.1): JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a…
CVE-2026-59317 — Medium (CVSS 6.5): DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and…
CVE-2026-41727 — Medium (CVSS 6.5): Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on…
CVE-2026-41726 — Medium (CVSS 6.5): When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending…
CVE-2023-34040 — Medium (CVSS 5.3): In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector…

All CVEs affecting Vmware Spring For Apache Kafka →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-54734 — Critical (CVSS 10.0): Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate…
CVE-2026-76193 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in…
CVE-2026-69502 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a…
CVE-2026-65801 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges…
CVE-2026-48331 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in…
CVE-2026-54735 — Critical (CVSS 10.0): Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →