CVE-2026-41727

In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

State: Published
Severity: 6.5 Medium
Published: Jun 9, 2026
Updated: Jun 27, 2026
Reserved: Apr 22, 2026

Description

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.

Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	vmware

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Spring for Apache KafkaSpring	4.0.0 to before 4.0.5.1Affected 3.3.0 to before 3.3.15.1Affected 3.2.0 to before 3.2.14Affected 2.9.0 to before 2.9.14Affected 2.8.0 to before 2.8.12Affected

References

https://spring.io/security/cve-2026-41727

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.