CVE-2026-41727 In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

🗓️ 09 Jun 2026 23:49:10Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

Spring Kafka retry topic headers can be forged to subvert retry routing and backoff.

Reporter	Title	Published	Views	Family All 11
CNNVD	VMware Spring for Apache Kafka 输入验证错误漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41727	9 Jun 202623:49	–	cve
Cvelist	CVE-2026-41727 In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior	9 Jun 202623:49	–	cvelist
EUVD	EUVD-2026-35904	10 Jun 202600:31	–	euvd
NVD	CVE-2026-41727	10 Jun 202600:16	–	nvd
Positive Technologies	PT-2026-48323	9 Jun 202600:00	–	ptsecurity
Snyk	Improper Validation of Specified Quantity in Input	10 Jun 202601:13	–	snyk
Spring Security Advisories	CVE-2026-41727: In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior	9 Jun 202600:00	–	spring
vulnersOsv	be.appify.prefab:prefab-annotation-processor (>=0.2.0 <=0.10.2), be.appify.prefab:prefab-core (=0.2.0) +162 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0-M2 <=4.0.5)	10 Jun 202601:13	–	vulnersosv
vulnersOsv	ai.langsa:ccaas-starter (>=0.1 <=cloud-0.3), ai.langsa:pom-ccaas-langsa (=0.1) +556 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=3.0.0 <=3.3.15)	10 Jun 202601:13	–	vulnersosv

Source	Link
spring	www.spring.io/security/cve-2026-41727
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41727.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41727

08 Jul 2026 08:13Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

EPSS0.0024

spring kafka forged headers retry routing backoff behavior header values retry attempts header