Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spring-projects/spring-kafka

              main @ 1f74ccd
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Deserialization: 1 prior fix. Scrutinize any change in this area.

DefaultKafkaHeaderMapper: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Trusted package check used startsWith, allowing subpackages of trusted packages to be deserialized, enabling dangerous JDK classes.

Information Disclosure / SSRF: Deserialization of java.net types triggered DNS lookups and network side effects, leading to SSRF.

Insecure Deserialization: ObjectInputStream allowed arbitrary class deserialization from exception headers; fixed by restricting to DeserializationException only.