CVE-2026-41727

Analyzed Analyzed - Analysis Complete

Header Manipulation in Spring for Apache Kafka

Publication date: 2026-06-10

Last updated on: 2026-06-27

Assigner: VMware

Description

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-27

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-41727

EUVD

EUVD-2026-35904

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_for_apache_kafka	From 2.8.0 (inc) to 2.8.11 (inc)
vmware	spring_for_apache_kafka	From 2.9.0 (inc) to 2.9.13 (inc)
vmware	spring_for_apache_kafka	From 3.2.0 (inc) to 3.2.13 (inc)
vmware	spring_for_apache_kafka	From 3.3.0 (inc) to 3.3.15 (inc)
vmware	spring_for_apache_kafka	From 4.0.0 (inc) to 4.0.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-41727 is a medium-severity vulnerability in Spring for Apache Kafka versions 2.8.0 through 4.0.5. It arises because the retry topic infrastructure does not sufficiently validate user-controlled header values.

An attacker can exploit this by sending a record with a specially crafted retry_topic-attempts header containing an out-of-range attempt count. This causes the retry topic router to misidentify the message's position in the retry sequence.

Additionally, the retry_topic_backoff-timestamp header can be manipulated without bounds checking, allowing an attacker to set an arbitrarily long pause, effectively stalling the listener beyond the intended retry window.

Impact Analysis

This vulnerability can impact you by allowing an attacker to disrupt the normal retry processing of messages in Spring for Apache Kafka.

Specifically, by manipulating the retry_topic-attempts header, the attacker can cause the system to misroute messages in the retry sequence.

By manipulating the retry_topic_backoff-timestamp header, the attacker can stall the listener for an arbitrarily long time, potentially causing denial of service or delays in message processing.

Mitigation Strategies

The primary mitigation step is to upgrade Spring for Apache Kafka to the fixed versions that address this vulnerability.

No additional mitigation steps are necessary beyond upgrading.

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-41727 on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-41727. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70