CVE-2026-41726: In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-23
Weakness: CWE-770

Description

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Affected products

Spring for Apache Kafka: before 2.8.12; from 2.9.0 before 2.9.14; from 3.2.0 before 3.2.14; from 3.3.0 before 3.3.15.1; from 4.0.0 before 4.0.5.1 — fixed in 2.8.12, 2.9.14, 3.2.14, 3.3.15.1, 4.0.5.1
Spring for Apache Kafka: from 4.0.0 before 4.0.5.1; from 3.3.0 before 3.3.15.1; from 3.2.0 before 3.2.14; from 2.9.0 before 2.9.14; from 2.8.0 before 2.8.12 — fixed in 4.0.5.1, 3.3.15.1, 3.2.14, 2.9.14, 2.8.12

How to fix

Upgrade to a fixed version: Spring for Apache Kafka 2.8.12, 2.9.14, 3.2.14, 3.3.15.1; Spring for Apache Kafka 4.0.5.1, 3.3.15.1, 3.2.14, 2.9.14. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-41726

Get alerted when CVE-2026-41726 or the next vulnerability affects your stack