CVE-2026-41727: In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-23
Weakness: CWE-20

Description

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Affected products

Spring for Apache Kafka: from 2.8.0 before 2.8.12; from 2.9.0 before 2.9.14; from 3.2.0 before 3.2.14; from 3.3.0 before 3.3.15.1; from 4.0.0 before 4.0.5.1 — fixed in 2.8.12, 2.9.14, 3.2.14, 3.3.15.1, 4.0.5.1
Spring for Apache Kafka: from 4.0.0 before 4.0.5.1; from 3.3.0 before 3.3.15.1; from 3.2.0 before 3.2.14; from 2.9.0 before 2.9.14; from 2.8.0 before 2.8.12 — fixed in 4.0.5.1, 3.3.15.1, 3.2.14, 2.9.14, 2.8.12

How to fix

Upgrade to a fixed version: Spring for Apache Kafka 2.8.12, 2.9.14, 3.2.14, 3.3.15.1; Spring for Apache Kafka 4.0.5.1, 3.3.15.1, 3.2.14, 2.9.14. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-41727

Get alerted when CVE-2026-41727 or the next vulnerability affects your stack