CVE-2026-41727
In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Record
CVE-2026-41727- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-35904
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Record
EUVD-2026-35904- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-53w6-v7cv-fc9h
Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Record
GHSA-53w6-v7cv-fc9h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Record
CVE-2026-41727- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Record
CVE-2026-41727- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-53w6-v7cv-fc9h
Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
- Record
GHSA-53w6-v7cv-fc9h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1793883738 No score
TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 2.8.5-tuxcare.1.
- Record
CLSA-2026-1793883738- Updated
- 2026-11-06
OSVCLSA-2026-1793883976 No score
TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 2.8.6-tuxcare.1.
- Record
CLSA-2026-1793883976- Updated
- 2026-11-06
OSVCLSA-2026-1793885501 No score
TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 3.1.5-tuxcare.2.
- Record
CLSA-2026-1793885501- Updated
- 2026-11-06
OSVCLSA-2026-1793885795 No score
TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 3.2.9-tuxcare.2.
- Record
CLSA-2026-1793885795- Updated
- 2026-11-06
OSVCLSA-2026-1793887316 No score
TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 3 CVEs. Fixed in 3.2.10-tuxcare.4.
- Record
CLSA-2026-1793887316- Updated
- 2026-11-06
OSVCLSA-2026-1793888140 No score
TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 1 CVE. Fixed in 2.9.13-tuxcare.3.
- Record
CLSA-2026-1793888140- Updated
- 2026-11-06
OSVCLSA-2026-1793888496 No score
TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 1 CVE. Fixed in 3.3.11-tuxcare.3.
- Record
CLSA-2026-1793888496- Updated
- 2026-11-06
OSVCLSA-2026-1793888664 No score
TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 1 CVE. Fixed in 3.0.13-tuxcare.4.
- Record
CLSA-2026-1793888664- Updated
- 2026-11-06
OSVCLSA-2026-1793888997 No score
TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 1 CVE. Fixed in 2.8.11-tuxcare.3.
- Record
CLSA-2026-1793888997- Updated
- 2026-11-06
OSVCLSA-2026-1793889503 No score
TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)
TuxCare rebuilt org.springframework.kafka:spring-kafka to address 1 CVE. Fixed in 3.1.10-tuxcare.4.
- Record
CLSA-2026-1793889503- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.kafka:spring-kafkaMaven |
4.0.0 to 4.0.5 | 4.0.6 |
org.springframework.kafka:spring-kafkaMaven |
3.3.0 to 3.3.15 | 3.3.16 |
org.springframework.kafka:spring-kafkaMaven |
3.2.0 to 3.2.13 | None known |
org.springframework.kafka:spring-kafkaMaven |
2.9.0 to 2.9.13 | None known |
org.springframework.kafka:spring-kafkaMaven |
through 2.8.11 | None known |
org.springframework.kafka:spring-kafkaTuxCare:Maven From an advisory covering 3 CVEs |
2.8.5 up to 2.8.5-tuxcare.1 | 2.8.5-tuxcare.1 |
org.springframework.kafka:spring-kafkaTuxCare:Maven From an advisory covering 3 CVEs |
2.8.6 up to 2.8.6-tuxcare.1 | 2.8.6-tuxcare.1 |
org.springframework.kafka:spring-kafkaTuxCare:Maven From an advisory covering 3 CVEs |
3.1.5 up to 3.1.5-tuxcare.2, plus listed versions 3.1.5-tuxcare.1 |
3.1.5-tuxcare.2 |
org.springframework.kafka:spring-kafkaTuxCare:Maven From an advisory covering 3 CVEs |
3.2.9 up to 3.2.9-tuxcare.2, plus listed versions 3.2.9-tuxcare.1 |
3.2.9-tuxcare.2 |
org.springframework.kafka:spring-kafkaTuxCare:Maven From an advisory covering 3 CVEs |
3.2.10 up to 3.2.10-tuxcare.4, plus listed versions 3.2.10-tuxcare.13.2.10-tuxcare.23.2.10-tuxcare.3 |
3.2.10-tuxcare.4 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.kafka:spring-kafkaTuxCare:Maven |
2.9.13 up to 2.9.13-tuxcare.3, plus listed versions 2.9.13-tuxcare.12.9.13-tuxcare.2 |
2.9.13-tuxcare.3 |
org.springframework.kafka:spring-kafkaTuxCare:Maven |
3.3.11 up to 3.3.11-tuxcare.3, plus listed versions 3.3.11-tuxcare.13.3.11-tuxcare.2 |
3.3.11-tuxcare.3 |
org.springframework.kafka:spring-kafkaTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.4, plus listed versions 3.0.13-tuxcare.13.0.13-tuxcare.23.0.13-tuxcare.3 |
3.0.13-tuxcare.4 |
org.springframework.kafka:spring-kafkaTuxCare:Maven |
2.8.11 up to 2.8.11-tuxcare.3, plus listed versions 2.8.11-tuxcare.12.8.11-tuxcare.2 |
2.8.11-tuxcare.3 |
org.springframework.kafka:spring-kafkaTuxCare:Maven |
3.1.10 up to 3.1.10-tuxcare.4, plus listed versions 3.1.10-tuxcare.13.1.10-tuxcare.23.1.10-tuxcare.3 |
3.1.10-tuxcare.4 |
org.springframework.kafka:spring-kafkaMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
org.springframework.kafka:spring-kafkaMaven |
3.3.0 up to 3.3.16, plus listed versions 3.3.13.3.103.3.113.3.123.3.13 Show 10 moreShow less3.3.143.3.153.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.9 |
3.3.16 |
org.springframework.kafka:spring-kafkaMaven |
3.2.0 to 3.2.13, plus listed versions 3.2.13.2.103.2.23.2.33.2.4 Show 5 moreShow less3.2.53.2.63.2.73.2.83.2.9 |
None known |
org.springframework.kafka:spring-kafkaMaven |
2.9.0 to 2.9.13, plus listed versions 2.9.12.9.102.9.112.9.122.9.2 Show 7 moreShow less2.9.32.9.42.9.52.9.62.9.72.9.82.9.9 |
None known |
org.springframework.kafka:spring-kafkaMaven |
through 2.8.11, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE Show 45 moreShow less1.0.5.RELEASE1.0.6.RELEASE1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.10.RELEASE1.3.11.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.3.9.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE2.1.0.RELEASE2.1.1.RELEASE2.1.10.RELEASE2.1.11.RELEASE2.1.12.RELEASE2.1.13.RELEASE2.1.14.RELEASE2.1.2.RELEASE2.1.3.RELEASE |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41727 is a medium vulnerability (CVSS 6.5) in Spring For Apache Kafka, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in org.springframework.kafka:spring-kafka 4.0.6.
References
spring.io/security/cve-2026-41727
nvd.nist.gov/vuln/detail/CVE-2026-41727
github.com/spring-projects/spring-kafka/releases/tag/v3.3.16
Left out here: 109 versions. The JSON record has them.