com.github.pscosta:kafka-proto-api (1.0), org.apereo.cas:cas-server-core-configuration-cloud-kafka (5.2.0-rc4) +1 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.pscosta:kafka-proto-api 1.0 -...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +407 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=3.3.0, <=3.3.15)

org.springframework.kafka:spring-kafka MAVEN version =3.3.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =2.2.1, =8.15.0, =8.15.0, =8.15.0, =8.4.0, =11.11.0 and more Source cves: CVE-2026-41727 Source advisory: OSV:GHSA-53W6-V7CV-FC9H...

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

GHSA-XVFQ-4Q6Q-GXX7 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

com.blibli.oss:kafka-plugin (>=0.0.1, <=2.1.0), com.github.cirola2000:idol-metadata (0.0.1) +65 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.7.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.blibli.oss:kafka-plugin =0.0.1, =0.0.5, =1.3.0.release, =1.3.0.release,...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +407 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=3.3.0, <=3.3.15)

org.springframework.kafka:spring-kafka MAVEN version =3.3.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =2.2.1, =8.15.0, =8.15.0, =8.15.0, =8.4.0, =11.11.0 and more Source cves: CVE-2026-41731 Source advisory: OSV:GHSA-XQ69-5H5V-X9X4...

de.idealo.kafka:kafka-encryption (0.1-20180118), de.idealo.kafka:kafka-encryption-demo-app (>=0.1-20180111, <=0.1-20180118) +1 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.3.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - de.idealo.kafka:kafka-encryption 0.1-20180118 -...

io.kermoss:reactive-business-flow (0.0.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.8.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - io.kermoss:reactive-business-flow 0.0.1.release Source cves: CVE-2026-41726...

org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09 (1.2.0.release), org.springframework.cloud.stream.app:bridge-processor-kafka-09 (1.2.0.release) +55 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.0.5.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09...

org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-10 (1.2.0.release), org.springframework.cloud.stream.app:bridge-processor-kafka-10 (1.2.0.release) +54 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.1.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-10...

org.springframework.cloud:spring-cloud-starter-bus-kafka (1.3.1.release), org.springframework.cloud:spring-cloud-stream-docs (chelsea.sr2) potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.1.4.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-bus-kafka 1.3.1.release -...

cn.stylefeng.roses:kernel-logger (>=1.0.0, <=2.2.3), com.github.lujiannt:kernel-logger (1.0.0) +4 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - cn.stylefeng.roses:kernel-logger =1.0.0, =0.0.2, =0.0.2, =5.2.0-rc1,...

org.apereo.cas:cas-server-core-configuration-cloud-kafka (>=5.0.0.rc3, <=5.0.10), org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09 (1.1.1.release) +50 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.0.4.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-kafka =5.0.0.rc3, =5.0.1...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

cn.stylefeng.roses:kernel-logger (>=1.0.0, <=2.2.3), com.github.lujiannt:kernel-logger (1.0.0) +4 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.2.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - cn.stylefeng.roses:kernel-logger =1.0.0, =0.0.2, =0.0.2, =5.2.0-rc1,...

com.github.eventasia:eventasia-stream-kafka (>=0.0.12.release, <=0.0.13.release), org.apereo.cas:cas-server-core-configuration-cloud-kafka (>=5.1.0-rc4, <=5.1.9) +1 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:eventasia-stream-kafka =0.0.12.release, =5.1.0-rc4,...

org.springframework.integration:spring-integration-kafka (2.0.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.0.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.0.1.release Sour...

org.apache.skywalking:apm-spring-kafka-1.x-plugin (>=8.3.0, <=9.6.0) potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.3.11.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.apache.skywalking:apm-spring-kafka-1.x-plugin =8.3.0, =9.6.0 Source...

com.github.eventasia:event-store (>=0.0.1.release, <=0.0.3.release), com.github.eventasia:eventasia-starter (>=0.0.4.release, <=0.0.10.release) +4 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.0.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:event-store =0.0.1.release, =0.0.4.release,...