Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41727In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Medium 6.5
In plain English
A medium-severity improper input validation in Spring for Apache Kafka from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.kafka:spring-kafka | 4.0.6 | GHSA-53w6-v7cv-fc9h |
| Maven | org.springframework.kafka:spring-kafka | 3.3.16 | GHSA-53w6-v7cv-fc9h |
| Maven | org.springframework.kafka:spring-kafka | no fix listed | GHSA-53w6-v7cv-fc9h |
| Maven | org.springframework.kafka:spring-kafka | no fix listed | GHSA-53w6-v7cv-fc9h |
| Maven | org.springframework.kafka:spring-kafka | no fix listed | GHSA-53w6-v7cv-fc9h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring for Apache Kafka | 4.0.0 – before 4.0.5.13.3.0 – before 3.3.15.13.2.0 – before 3.2.142.9.0 – before 2.9.142.8.0 – before 2.8.12 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H