CVE-2026-41727

Name of the Vulnerable Software and Affected Versions Spring for Apache Kafka versions 4.0.0 through 4.0.5 Spring for Apache Kafka versions 3.3.0 through 3.3.15 Spring for Apache Kafka versions 3.2.0 through 3.2.13 Spring for Apache Kafka versions 2.9.0 through 2.9.13 Spring for Apache Kafka versions 2.8.0 through 2.8.11

Description The retry topic infrastructure fails to sufficiently validate user-controlled header values. A producer can send a record containing a crafted retry topic-attempts header with an out-of-range attempt count, leading the retry topic router to misidentify the message's position within the retry sequence and subverting routing and backoff behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.