Spring Kafka 2.8.x Release Notes

Security Fixes

• An empty or oversized retry timestamp header no longer aborts dead-letter publication and leaves a record reprocessing indefinitely, because DeadLetterPublishingRecovererFactory now falls back to the record's own timestamp (medium severity, CVE-2026-59317).
• Producer-controlled network-address header types can no longer trigger attacker-controlled DNS lookups during deserialization, because DefaultKafkaHeaderMapper never trusts the java.net address types and returns such headers as a NonTrustedHeaderType even when their package is trusted (medium severity, CVE-2026-59278).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.28
• Spring Framework (NES) 5.3.39-spring-framework-5.3.54
• Spring Retry (NES) 1.3.4-spring-retry-1.3.13

Security Fixes

• Bounded the selector lookup cache in DelegatingDeserializer to prevent unbounded consumer heap growth from records carrying unique spring.kafka.serialization.selector header values (CVE-2026-41726).
• Hardened decoding of the user-controlled retry_topic-attempts and retry_topic_backoff-timestamp headers in DeadLetterPublishingRecovererFactory and KafkaBackoffAwareMessageListenerAdapter, preventing a producer from misrepresenting retry attempts or stalling the listener (CVE-2026-41727).
• Fixed JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper to require exact trusted-package matches for type headers, preventing deserialization of arbitrary JDK classes from malicious headers (CVE-2026-41731).

Dependency Upgrades

• Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.27
• Spring Framework (NES) 5.3.39-spring-framework-5.3.52
• Spring Retry (NES) 1.3.4-spring-retry-1.3.12

Security Fixes

• This patches the Spring Kafka Java Deserialization When Improperly Configured CVE (CVE-2023-34040).