CVE-2026-41726: In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use DelegatingDeserializer when the records (specifically the spring.kafka.serialization.selector header) can be influenced by an untrusted producer; ensure the selector/header values are not user-controlled and cannot grow the delegate cache without bound.
Spring for Apache Kafka (DelegatingDeserializer / kafka serialization) spring.kafka.serialization.selector header usage = Do not allow a user-controlled/unbounded selector value to be used as a cache key (avoid DelegatingDeserializer with untrusted data)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41726?
CVE-2026-41726 has a medium severity rating of 6.5.
How do I fix CVE-2026-41726?
To fix CVE-2026-41726, upgrade to a non-vulnerable version of Spring for Apache Kafka that addresses this issue.
What systems are affected by CVE-2026-41726?
CVE-2026-41726 affects applications using Spring for Apache Kafka 4.0.0 and potentially earlier versions that enable DelegatingDeserializer.
What is the risk associated with CVE-2026-41726?
The risk associated with CVE-2026-41726 is the potential for memory exhaustion leading to OutOfMemoryError due to unbounded cache growth.
What is the exploit scenario for CVE-2026-41726?
The exploit scenario for CVE-2026-41726 involves a producer sending records with unique random spring.kafka.serialization.selector header values, overwhelming the consumer's heap.