{"id":"CVE-2026-41726","aliases":["GHSA-xvfq-4q6q-gxx7"],"title":"In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header","summary":"In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header","severity":"medium","cvss":6.5,"cwe":["CWE-770"],"vendor":"springframework","product":"org.springframework.kafka:spring-kafka","ecosystem":"maven","affected":["org.springframework.kafka:spring-kafka >= 4.0.0, <= 4.0.5","org.springframework.kafka:spring-kafka >= 3.3.0, <= 3.3.15","org.springframework.kafka:spring-kafka >= 3.2.0, <= 3.2.13","org.springframework.kafka:spring-kafka >= 2.9.0, <= 2.9.13","org.springframework.kafka:spring-kafka <= 2.8.11"],"patched":["org.springframework.kafka:spring-kafka 4.0.6","org.springframework.kafka:spring-kafka 3.3.16"],"published":"2026-06-10","updated":"2026-06-12","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-xvfq-4q6q-gxx7","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41726"},{"url":"https://spring.io/security/cve-2026-41726"},{"url":"https://github.com/spring-projects/spring-kafka/issues/4489"},{"url":"https://github.com/spring-projects/spring-kafka/commit/ca2337ba789c5778a10197bda17a62915247ff6c"},{"url":"https://github.com/advisories/GHSA-xvfq-4q6q-gxx7"}],"tags":["ghsa","maven"],"epss":0.00296,"epssPercentile":0.2247,"ingestedAt":"2026-07-07T15:41:59.585Z","slug":"CVE-2026-41726","body":"## Overview\n\nWhen an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.\n\nAffected versions:\nSpring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.\n\n## Affected packages\n\n- `org.springframework.kafka:spring-kafka >= 4.0.0, <= 4.0.5`\n- `org.springframework.kafka:spring-kafka >= 3.3.0, <= 3.3.15`\n- `org.springframework.kafka:spring-kafka >= 3.2.0, <= 3.2.13`\n- `org.springframework.kafka:spring-kafka >= 2.9.0, <= 2.9.13`\n- `org.springframework.kafka:spring-kafka <= 2.8.11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.springframework.kafka:spring-kafka 4.0.6`\n- `org.springframework.kafka:spring-kafka 3.3.16`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}