HeroDevs
Visit NES for Spring Home Page

Spring Kafka 2.8.x Release Notes

10 versions

Comprehensive release notes and changelog for Spring Kafka 2.8.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 15, 2026
Latest: 2.8.21
17 Patched Vulnerabilities
VEX Statements

June 2026

2.8.21

Released Jun 15, 2026
CVE-2026-41726
CVE-2026-41727
CVE-2026-41731
Full Version: 
2.8.11-spring-kafka-2.8.21

Bug Fixes

  • Bounded the selector lookup cache in DelegatingDeserializer to prevent unbounded consumer heap growth from records carrying unique spring.kafka.serialization.selector header values (CVE-2026-41726).
  • Hardened decoding of the user-controlled retry_topic-attempts and retry_topic_backoff-timestamp headers in DeadLetterPublishingRecovererFactory and KafkaBackoffAwareMessageListenerAdapter, preventing a producer from misrepresenting retry attempts or stalling the listener (CVE-2026-41727).
  • Fixed JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper to require exact trusted-package matches for type headers, preventing deserialization of arbitrary JDK classes from malicious headers (CVE-2026-41731).

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.27
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.52
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.12

April 2026

2.8.20

Released Apr 23, 2026
Full Version: 
2.8.11-spring-kafka-2.8.20

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.26
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.51
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.11

March 2026

2.8.19

Released Mar 25, 2026
Full Version: 
2.8.11-spring-kafka-2.8.19

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.25
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.50
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.10

October 2025

2.8.18

Released Oct 23, 2025
Full Version: 
2.8.11-spring-kafka-2.8.18

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.24
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.49

September 2025

2.8.17

Released Sep 30, 2025
Full Version: 
2.8.11-spring-kafka-2.8.17

Dependency Upgrades

  • Spring Retry (NES) 1.3.4-spring-retry-1.3.8

2.8.16

Released Sep 23, 2025
Full Version: 
2.8.11-spring-kafka-2.8.16

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.23
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.48

August 2025

2.8.15

Released Aug 25, 2025
Full Version: 
2.8.11-spring-kafka-2.8.15

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.22
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.47
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.8

May 2025

2.8.14

Released May 20, 2025
Full Version: 
2.8.11-spring-kafka-2.8.14

Dependency Upgrades

  • Spring Data BOM (NES): 2021.2.18-spring-data-bom-2021.2.21
  • Spring Framework (NES): 5.3.39-spring-framework-5.3.46
  • Spring Retry (NES): 1.3.4-spring-retry-1.3.7

March 2025

2.8.13

Released Mar 3, 2025
CVE-2023-34040
Full Version: 
2.8.11-spring-kafka-2.8.13

Bug Fixes

  • This patches the Spring Kafka Java Deserialization When Improperly Configured CVE (CVE-2023-34040).

February 2025

2.8.12

Released Feb 24, 2025
Full Version: 
2.8.11-spring-kafka-2.8.12

Notes

Dependency Upgrades

  • Spring Data BOM (NES): 2021.2.18-spring-data-bom-2021.2.20
  • Spring Framework (NES): 5.3.39-spring-framework-5.3.45
  • Spring Retry (NES): 1.3.4-spring-retry-1.3.6Full Version: 2.8.11-spring-kafka-2.8.12

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.