Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41726In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
Medium 6.5
In plain English
A medium-severity resource allocation without limits in Spring for Apache Kafka from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.kafka:spring-kafka | no fix listed | GHSA-xvfq-4q6q-gxx7 |
| Maven | org.springframework.kafka:spring-kafka | no fix listed | GHSA-xvfq-4q6q-gxx7 |
| Maven | org.springframework.kafka:spring-kafka | 4.0.6 | GHSA-xvfq-4q6q-gxx7 |
| Maven | org.springframework.kafka:spring-kafka | 3.3.16 | GHSA-xvfq-4q6q-gxx7 |
| Maven | org.springframework.kafka:spring-kafka | no fix listed | GHSA-xvfq-4q6q-gxx7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring for Apache Kafka | 4.0.0 – before 4.0.5.13.3.0 – before 3.3.15.13.2.0 – before 3.2.142.9.0 – before 2.9.142.8.0 – before 2.8.12 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H