Overview
About vulnerability
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list.
When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header.
Jackson’s built-in InetAddress deserialization calls InetAddress.getByName(), which immediately triggers a DNS resolution, enabling Server-Side Request Forgery (SSRF) in the default configuration.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Integration @ 5.5.19 (+390 more)