CVE-2026-41727

published 2026-06-10

CVE-2026-41727: Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record…

Priority P3 35 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.

Affected versions:
Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
spring	spring_for_apache_kafka	>= 2.8.0 < 2.8.12	2.8.12
spring	spring_for_apache_kafka	>= 2.9.0 < 2.9.14	2.9.14
spring	spring_for_apache_kafka	>= 3.2.0 < 3.2.14	3.2.14
spring	spring_for_apache_kafka	>= 3.3.0 < 3.3.15.1	3.3.15.1
spring	spring_for_apache_kafka	>= 4.0.0 < 4.0.5.1	4.0.5.1
vmware	spring_for_apache_kafka	2.8.0 – 2.8.11	—
vmware	spring_for_apache_kafka	2.9.0 – 2.9.13	—
vmware	spring_for_apache_kafka	3.2.0 – 3.2.13	—
vmware	spring_for_apache_kafka	3.3.0 – 3.3.15	—
vmware	spring_for_apache_kafka	4.0.0 – 4.0.5	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20