CVE-2026-41727 In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

Medium 6.5 Published 9 Jun 2026 Updated 27 Jun 2026

Attackers can manipulate retry topic routing and backoff behavior by sending crafted headers, disrupting message processing logic in Spring Kafka applications.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-41727?

CVE-2026-41727 is a medium-severity vulnerability in Spring for Apache Kafka, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.

Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Weakness: CWE-20

Which versions are affected by CVE-2026-41727?

10 open source packages ship an affected version, including org.springframework.kafka:spring-kafka. It affects 1 product.

Package	Affected	Fixed in
`org.springframework.kafka:spring-kafka` Maven	All versions to `2.8.11`	None
`org.springframework.kafka:spring-kafka` Maven	All versions to `2.8.11`	None
`org.springframework.kafka:spring-kafka` Maven	From `2.9.0` to `2.9.13`	None
`org.springframework.kafka:spring-kafka` Maven	From `2.9.0` to `2.9.13`	None
`org.springframework.kafka:spring-kafka` Maven	From `3.2.0` to `3.2.13`	None
`org.springframework.kafka:spring-kafka` Maven	From `3.2.0` to `3.2.13`	None

4 more packages

`org.springframework.kafka:spring-kafka` Maven	From `3.3.0`	`3.3.16`
`org.springframework.kafka:spring-kafka` Maven	From `3.3.0`	`3.3.16`
`org.springframework.kafka:spring-kafka` Maven	From `4.0.0`	`4.0.6`
`org.springframework.kafka:spring-kafka` Maven	From `4.0.0`	`4.0.6`

Products include Vmware Spring for Apache Kafka.

How do I fix CVE-2026-41727?

Upgrade org.springframework.kafka:spring-kafka to a fixed version for your release line: 3.3.16 or 4.0.6.

Is CVE-2026-41727 being exploited?

There is no known exploitation of CVE-2026-41727 in the wild and no public exploit code.

Sources

Also known as GHSA-53w6-v7cv-fc9h, MINI-3hj8-m4vp-4973, MINI-qqv4-497r-8c29.