CVE-2026-41726 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

Medium 6.5 Published 9 Jun 2026 Updated 27 Jun 2026

Attackers can cause denial of service via memory exhaustion in Spring for Apache Kafka when DelegatingDeserializer is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-41726?

CVE-2026-41726 is a medium-severity denial of service vulnerability in Spring for Apache Kafka, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.

Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Weakness: CWE-770

Which versions are affected by CVE-2026-41726?

10 open source packages ship an affected version, including org.springframework.kafka:spring-kafka. It affects 1 product.

Package	Affected	Fixed in
`org.springframework.kafka:spring-kafka` Maven	All versions to `2.8.11`	None
`org.springframework.kafka:spring-kafka` Maven	All versions to `2.8.11`	None
`org.springframework.kafka:spring-kafka` Maven	From `2.9.0` to `2.9.13`	None
`org.springframework.kafka:spring-kafka` Maven	From `2.9.0` to `2.9.13`	None
`org.springframework.kafka:spring-kafka` Maven	From `3.2.0` to `3.2.13`	None
`org.springframework.kafka:spring-kafka` Maven	From `3.2.0` to `3.2.13`	None

4 more packages

`org.springframework.kafka:spring-kafka` Maven	From `3.3.0`	`3.3.16`
`org.springframework.kafka:spring-kafka` Maven	From `3.3.0`	`3.3.16`
`org.springframework.kafka:spring-kafka` Maven	From `4.0.0`	`4.0.6`
`org.springframework.kafka:spring-kafka` Maven	From `4.0.0`	`4.0.6`

Products include Vmware Spring for Apache Kafka.

How do I fix CVE-2026-41726?

Upgrade org.springframework.kafka:spring-kafka to a fixed version for your release line: 3.3.16 or 4.0.6.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-41726 being exploited?

There is no known exploitation of CVE-2026-41726 in the wild and no public exploit code.

Sources

Also known as GHSA-xvfq-4q6q-gxx7, MINI-7qxh-4v87-x89x, MINI-qc59-jcqj-grfh, ROOT-APP-MAVEN-CVE-2026-41726.