MEDIUM | JUNE 09, 2026 | CVE-2026-41727
Description
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them.
A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Separately, the retry_topic_backoff-timestamp header was accepted without bounds checking, meaning a forged
timestamp could instruct the backoff manager to impose an arbitrarily long pause, stalling the listener far beyond any intended retry window.
Affected Spring Products and Versions
Spring for Apache Kafka:
- 4.0.0 - 4.0.5
- 3.3.0 - 3.3.15
- 3.2.0 - 3.2.13
- 2.9.0 - 2.9.13
- 2.8.0 - 2.8.11
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 4.0.x | 4.0.6 | OSS |
| 4.0.5.1 | Commercial | |
| 3.3.x | 3.3.16 | OSS |
| 3.3.15.1 | Commercial | |
| 3.2.x | 3.2.14 | Commercial |
| 2.9.x | 2.9.14 | Commercial |
| 2.8.x | 2.8.12 | Commercial |
No further mitigation steps are necessary.
Credit
This issue was discovered internally.
References
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy