AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502

https://access.redhat.com/security/cve/CVE-2026-41731

https://bugzilla.redhat.com/show_bug.cgi?id=2487375

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41731.json

[{"vendor":"Red Hat","product":"Red Hat Fuse 7","defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","defaultStatus":"affected","cpes":["cpe:/a:redhat:jbosseapxp"]}]

[{"vendor":"Spring","product":"Spring for Apache Kafka","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.6","versionType":"custom","status":"affected"},{"version":"3.3.0","lessThan":"3.3.16","versionType":"custom","status":"affected"},{"version":"3.2.0","lessThan":"3.2.14","versionType":"custom","status":"affected"},{"version":"2.9.0","lessThan":"2.9.14","versionType":"custom","status":"affected"},{"version":"2.8.0","lessThan":"2.8.12","versionType":"custom","status":"affected"}]}]

[{"vendor":"Spring","product":"Spring for Apache Kafka","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.5.1","versionType":"custom","status":"affected"},{"version":"3.3.0","lessThan":"3.3.15.1","versionType":"custom","status":"affected"},{"version":"3.2.0","lessThan":"3.2.14","versionType":"custom","status":"affected"},{"version":"2.9.0","lessThan":"2.9.14","versionType":"custom","status":"affected"},{"version":"2.8.0","lessThan":"2.8.12","versionType":"custom","status":"affected"}]}]

OR
          *cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (including) 2.8.11
          *cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:* versions from (including) 2.9.0 up to (including) 2.9.13
          *cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:* versions from (including) 3.2.0 up to (including) 3.2.13
          *cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:* versions from (including) 3.3.0 up to (including) 3.3.15
          *cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (including) 4.0.5

VMware: https://spring.io/security/cve-2026-41731 Types: Vendor Advisory

{"timestamp":"2026-06-10T17:18:09.377824Z","id":"CVE-2026-41731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Spring","product":"Spring for Apache Kafka","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.6","versionType":"custom","status":"affected"},{"version":"3.3.0","lessThan":"3.3.16","versionType":"custom","status":"affected"},{"version":"3.2.0","lessThan":"3.2.14","versionType":"custom","status":"affected"},{"version":"2.9.0","lessThan":"2.9.14","versionType":"custom","status":"affected"},{"version":"2.8.0","lessThan":"2.8.12","versionType":"custom","status":"affected"}]}]

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.

Affected versions:
Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502

https://spring.io/security/cve-2026-41731