CVE-2026-41727: In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retrytopic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41727?
The severity of CVE-2026-41727 is medium, rated at 6.5.
What does CVE-2026-41727 affect?
CVE-2026-41727 affects the Spring for Apache Kafka framework.
How do I fix CVE-2026-41727?
To fix CVE-2026-41727, you should upgrade Spring for Apache Kafka to the latest version that addresses the vulnerability.
What are the potential risks associated with CVE-2026-41727?
Exploitation of CVE-2026-41727 can lead to incorrect retry routing and backoff behavior due to unvalidated header values.
What is the primary cause of CVE-2026-41727?
The primary cause of CVE-2026-41727 is insufficient validation of user-controlled header values in the retry topic infrastructure.