When an application opts into DelegatingDeserializer , a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError . Only deployments that explicitly configured DelegatingDeserializer are affected.
Versions that are no longer supported are also affected.
Users of affected versions should upgrade to the corresponding fixed version.
No further mitigation steps are necessary.
This issue was discovered internally.
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Check out all the upcoming events in the Spring community.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
