CVE-2026-41726

Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka versions 4.0.0 through 4.0.5 Spring for Apache Kafka versions 3.3.0 through 3.3.15 Spring for Apache Kafka versions 3.2.0 through 3.2.13 Spring for Apache Kafka versions 2.9.0 through 2.9.13 Spring for Apache Kafka versions 2.8.0 through 2.8.11

Description When an application uses DelegatingDeserializer, a producer can cause unbounded heap growth in the consumer. This is achieved by sending records containing unique random values in the spring.kafka.serialization.selector header, which eventually leads to garbage collection thrashing and an OutOfMemoryError.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.