CVE-2026-41727

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-41727	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::

History

No history.

Information

Published : 2026-06-10 00:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-41727

Mitre link : CVE-2026-41727

CVE.ORG link : CVE-2026-41727

JSON object : View

Products Affected

vmware

spring_for_apache_kafka

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-41727", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41727", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T17:33:57.867244Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring for Apache Kafka", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.5.1", "versionType": "custom"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.15.1", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.14", "versionType": "custom"}, {"status": "affected", "version": "2.9.0", "lessThan": "2.9.14", "versionType": "custom"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.8.12", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-10T00:16:52.143", "references": [{"url": "https://spring.io/security/cve-2026-41727", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.\n\nAffected versions:\nSpring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11."}, {"lang": "es", "value": "La infraestructura de temas de reintento de Spring Kafka no validaba suficientemente los valores de encabezado controlados por el usuario antes de actuar sobre ellos. Un productor podr\u00eda enviar un registro con un encabezado retry_topic-attempts manipulado para proporcionar un recuento de intentos fuera de rango y hacer que el router del tema de reintento identifique err\u00f3neamente d\u00f3nde estaba el mensaje en la secuencia de reintento.\n\nVersiones afectadas:\nSpring for Apache Kafka 4.0.0 hasta 4.0.5; 3.3.0 hasta 3.3.15; 3.2.0 hasta 3.2.13; 2.9.0 hasta 2.9.13; 2.8.0 hasta 2.8.11."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3210AF28-E5BC-4976-BF43-339DADA089FC", "versionEndExcluding": "2.8.12", "versionStartIncluding": "2.8.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA023945-8D2F-4B64-8819-AA41F087BC18", "versionEndExcluding": "2.9.14", "versionStartIncluding": "2.9.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63E0CB29-F9CC-498A-8795-1344AECBBA74", "versionEndExcluding": "3.2.14", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A5CE749-924C-46F0-AD18-1FAE9FA29FCC", "versionEndExcluding": "3.3.15.1", "versionStartIncluding": "3.3.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C97EF8-CDE8-47B9-B1B6-9DE53F3FF907", "versionEndExcluding": "4.0.5.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}