Spring Kafka 2.7.x Release Notes

Bug Fixes

• Bounded the selector lookup cache in DelegatingDeserializer to prevent unbounded consumer heap growth from records carrying unique spring.kafka.serialization.selector header values (CVE-2026-41726).
• Hardened decoding of the user-controlled retry_topic-attempts and retry_topic_backoff-timestamp headers in DeadLetterPublishingRecovererFactory and KafkaBackoffAwareMessageListenerAdapter, preventing a producer from misrepresenting retry attempts or stalling the listener (CVE-2026-41727).
• Fixed JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper to require exact trusted-package matches for type headers, preventing deserialization of arbitrary JDK classes from malicious headers (CVE-2026-41731).

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.16
• Spring Framework (NES) 5.3.39-spring-framework-5.3.52
• Spring Retry (NES) 1.3.4-spring-retry-1.3.12

Bug Fixes

• Java deserialization when improperly configured (CVE-2023-34040).
  • org.springframework.kafka:spring-kafka:2.7.14-spring-kafka-2.7.15

Notes

• This release originates from the open‑source Spring Kafka repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Kafka 2.7.14.

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.13
• Spring Framework (NES) 5.3.39-spring-framework-5.3.49
• Spring Retry (NES) 1.3.4-spring-retry-1.3.9