JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net classes in their default trusted packages. When a Kafka consumer on a Spring application receives a message with a spring_json_header_types header that contains an java.net.InetAddress type, the framework unmarshals it without proper validation. This allows an external producer to cause the broker to resolve a DNS address controlled by the attacker, creating a Server‑Side Request Forgery (SSRF) that can reach internal services or exfiltrate data.

The discovery applies to Spring for Apache Kafka releases 4.1.0, 4.0.0 through 4.0.6, 3.0.0 through 3.3.16, 2.9.0 through 2.9.14, and all 2.8.12 and earlier versions.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an attacker sending a crafted Kafka message to a consumer that uses the default header mapper. The attacker does not need elevated privileges within the application; the exploitation simply triggers DNS resolution from the Kafka broker or the Spring container, potentially exposing internal resources or enabling data exfiltration.