{"id":"spring-security-e65c0c82dbc6","seq":2097,"kind":"advisory","title":"cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages","url":"https://spring.io/security/cve-2026-59278","permalink":"https://vulnpulse.app/items/spring-security-e65c0c82dbc6","summary":"JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Jackson's built-in InetAddress deserialization calls InetAddress.getByName() , which immediately triggers a DNS resolution, enabling Server-Side Request Forgery (SSRF) in the default configuration.","severity":null,"techs":["spring","java"],"cves":["CVE-2026-59278"],"tags":["security"],"source":{"id":"spring-security","name":"Spring Security Advisories"},"published_at":"2026-08-20T00:00:00.000Z","fetched_at":"2026-10-21T16:17:45.704Z"}