PatchTheCVEspring for apache kafka vulnerabilities and fixes
Recent CVEs affecting spring for apache kafka, with upgrade or downgrade steps. 2 tracked.
Also searched as: springforapachekafka.
spring for apache kafka has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-27. Highest priority: CVE-2026-59317 (score 37/100).
- CVE-2026-59317 MEDIUM 6.5 UPGRADE DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerR
- CVE-2026-59278 MEDIUM 6.5 UPGRADE JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list
FAQ
How do I fix spring for apache kafka vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring for apache kafka being exploited right now?
None of the tracked spring for apache kafka CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring for apache kafka CVE should I patch first?
CVE-2026-59317 currently ranks highest (37/100): DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerR.