HeroDevs
Visit NES for Spring Home Page

Spring Kafka 3.3.x Release Notes

3 versions

Comprehensive release notes and changelog for Spring Kafka 3.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 28, 2026
Latest: 3.3.18
6 Patched Vulnerabilities
VEX Statements

August 2026

3.3.18

Released Aug 28, 2026
CVE-2026-59317
CVE-2026-59278
Full Version: 
3.3.16-spring-kafka-3.3.18

Security Fixes

  • An empty or oversized retry timestamp header no longer aborts dead-letter publication and leaves a record reprocessing indefinitely, because DeadLetterPublishingRecovererFactory now falls back to the record's own timestamp (medium severity, CVE-2026-59317).
  • Producer-controlled network-address header types can no longer trigger attacker-controlled DNS lookups during deserialization, because DefaultKafkaHeaderMapper never trusts the java.net address types and returns such headers as a NonTrustedHeaderType even when their package is trusted (medium severity, CVE-2026-59278).

Dependency Upgrades

  • Spring Data BOM (NES) 2024.1.13-spring-data-bom-2024.1.18
  • Spring Framework (NES) 6.2.19-spring-framework-6.2.21
  • Spring Retry (NES) 2.0.13-spring-retry-2.0.15

July 2026

3.3.17

Released Jul 9, 2026
Full Version: 
3.3.16-spring-kafka-3.3.17

Dependency Upgrades

  • Spring Data BOM (NES) 2024.1.13-spring-data-bom-2024.1.17
  • Spring Framework (NES) 6.2.19-spring-framework-6.2.20
  • Spring Retry (NES) 2.0.13-spring-retry-2.0.14

January 2026

3.3.12

Released Jan 28, 2026
Full Version: 
3.3.11-spring-kafka-3.3.12

Notes

  • This release originates from the open‑source Spring Kafka repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Kafka 3.3.11.

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.