K000162184: Spring Kafka vulnerability CVE-2026-41727

Security Advisory Description Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retrytopic-attempts header to supply an out-of-range attempt count and cause the retry topic...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +174 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0-m2, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0-m2, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-10 (1.2.0.release), org.springframework.cloud.stream.app:bridge-processor-kafka-10 (1.2.0.release) +54 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.1.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-10...

org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09 (1.2.0.release), org.springframework.cloud.stream.app:bridge-processor-kafka-09 (1.2.0.release) +55 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.0.5.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09...

io.kermoss:reactive-business-flow (0.0.1.release) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.3.8.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - io.kermoss:reactive-business-flow 0.0.1.release Source cves: CVE-2026-41727...

com.blibli.oss:kafka-plugin (>=0.0.1, <=2.1.0), com.github.cirola2000:idol-metadata (0.0.1) +65 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.1.7.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.blibli.oss:kafka-plugin =0.0.1, =0.0.5, =1.3.0.release, =1.3.0.release,...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +407 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=3.3.0, <=3.3.15)

org.springframework.kafka:spring-kafka MAVEN version =3.3.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =2.2.1, =8.15.0, =8.15.0, =8.15.0, =8.4.0, =11.11.0 and more Source cves: CVE-2026-41727 Source advisory: GHSA-53W6-V7CV-FC9H...

org.springframework.integration:spring-integration-kafka (2.0.1.release) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.0.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.0.1.release Sour...

org.springframework.integration:spring-integration-kafka (2.3.1.release) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.3.10.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.3.1.release...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +266 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=3.2.0, <=3.2.10)

org.springframework.kafka:spring-kafka MAVEN version =3.2.0, =cloud-0.1, =1.0.10, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =0.0.49, =1.0.7, =1.0.4, =1.0.4, =1.0.4, =1.0.5 and more Source cves: CVE-2026-41727 Source advisory: GHSA-53W6-V7CV-FC9H...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

ca.bc.gov.tno:service (>=0.0.1-alpha, <=0.0.6-alpha), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +743 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.0.0.release, <=2.8.11)

org.springframework.kafka:spring-kafka MAVEN version =2.0.0.release, =0.0.1-alpha, =1.0.4.r, =3.0.0.release, =3.0.0.release, =1.0.1, =0.0.1, =1.0.1, =0.0.2, =1.0.0, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41727 Source advisory: OSV:GHSA-53W6-V7CV-FC9H...

de.otto.eventsourcing:es-core (0.0.1), de.otto.eventsourcing:es-testsupport (0.0.1) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.2.1.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - de.otto.eventsourcing:es-core 0.0.1 - de.otto.eventsourcing:es-testsupport...

CVE-2026-41727

Summary: Spring for Apache Kafka’s retry topic infrastructure does not adequately validate user-controlled header values, allowing a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify a message’s position in the retry sequen...

cn.aradin:aradin-spring-actuator-starter (>=1.0.1, <=1.0.3), cn.caijava:caijava-all (>=1.0.1, <=1.0.3) +430 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.8.0, <=2.8.11)

org.springframework.kafka:spring-kafka MAVEN version =2.8.0, =1.0.1, =1.0.1, =0.0.2, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.0.3, =1.0.3, =3.16.2, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-41727 Source advisory: MEND:CVE-2026-41727...