Spring Kafka 2.7.x Release Notes

Security Fixes

• An empty or oversized retry timestamp header no longer aborts dead-letter publication and leaves a record reprocessing indefinitely, because DeadLetterPublishingRecovererFactory now falls back to the record's own timestamp (medium severity, CVE-2026-59317).
• Producer-controlled network-address header types can no longer trigger attacker-controlled DNS lookups during deserialization, because DefaultKafkaHeaderMapper never trusts the java.net address types and returns such headers as a NonTrustedHeaderType even when their package is trusted (medium severity, CVE-2026-59278).

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.17
• Spring Framework (NES) 5.3.39-spring-framework-5.3.54
• Spring Retry (NES) 1.3.4-spring-retry-1.3.13

Security Fixes

• Bounded the selector lookup cache in DelegatingDeserializer to prevent unbounded consumer heap growth from records carrying unique spring.kafka.serialization.selector header values (CVE-2026-41726).
• Hardened decoding of the user-controlled retry_topic-attempts and retry_topic_backoff-timestamp headers in DeadLetterPublishingRecovererFactory and KafkaBackoffAwareMessageListenerAdapter, preventing a producer from misrepresenting retry attempts or stalling the listener (CVE-2026-41727).
• Fixed JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper to require exact trusted-package matches for type headers, preventing deserialization of arbitrary JDK classes from malicious headers (CVE-2026-41731).

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.16
• Spring Framework (NES) 5.3.39-spring-framework-5.3.52
• Spring Retry (NES) 1.3.4-spring-retry-1.3.12

Security Fixes

• Java deserialization when improperly configured (CVE-2023-34040).
  • org.springframework.kafka:spring-kafka:2.7.14-spring-kafka-2.7.15

Notes

• This release originates from the open‑source Spring Kafka repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Kafka 2.7.14.

Dependency Upgrades

• Spring Data BOM (NES) 2021.0.12-spring-data-bom-2021.0.13
• Spring Framework (NES) 5.3.39-spring-framework-5.3.49
• Spring Retry (NES) 1.3.4-spring-retry-1.3.9