Improper Input Validation in Spring Kafka Affects Messaging Infrastructure
CVE-2026-41727

6.5MEDIUM

Key Information:

Vendor

Spring

Status
Spring For Apache Kafka
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41727?

The Spring Kafka framework has a vulnerability within its retry topic infrastructure where user-controlled header values are not adequately validated. An attacker could utilize this flaw by crafting a malicious 'retry_topic-attempts' header, potentially providing an out-of-range attempt count. This could lead the retry topic router to incorrectly determine the message's position within the retry sequence, causing improper message handling and processing. Addressing this vulnerability is critical for maintaining the integrity and functionality of messaging systems.

Affected Version(s)

Spring for Apache Kafka 4.0.0 < 4.0.5.1

Spring for Apache Kafka 3.3.0 < 3.3.15.1

Spring for Apache Kafka 3.2.0 < 3.2.14

References

https://spring.io/security/cve-2026-41727

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.