GHSA-XVFQ-4Q6Q-GXX7 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

EUVD-2026-35903

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0...

EUVD-2026-35906

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

GHSA-53W6-V7CV-FC9H Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retrytopic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the...

edu.asu.diging:giles-eco-requests (>=0.8, <=0.16), org.apereo.cas:cas-server-core-configuration-cloud-kafka (5.1.0-rc1) +98 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.1.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - edu.asu.diging:giles-eco-requests =0.8, =0.16 -...

com.github.eventasia:eventasia-stream-kafka (>=0.0.12.release, <=0.0.13.release), org.apereo.cas:cas-server-core-configuration-cloud-kafka (>=5.1.0-rc4, <=5.1.9) +1 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.2.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:eventasia-stream-kafka =0.0.12.release, =5.1.0-rc4,...

com.github.relai.vertx.springdata:mod-spring-data (0.5), io.fabric8:process-spring-boot-data (>=1.2.0.beta2, <=1.2.0.beta3) +23 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.8.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.relai.vertx.springdata:mod-spring-data 0.5 -...

EUVD-2026-35908

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retrytopic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +266 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=3.2.0, <=3.2.10)

org.springframework.kafka:spring-kafka MAVEN version =3.2.0, =cloud-0.1, =1.0.10, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =0.0.49, =1.0.7, =1.0.4, =1.0.4, =1.0.4, =1.0.5 and more Source cves: CVE-2026-41726 Source advisory: OSV:GHSA-XVFQ-4Q6Q-GXX7...

com.blibli.oss:kafka-plugin (>=0.0.1, <=2.1.0), com.github.cirola2000:idol-metadata (0.0.1) +65 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.7.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.blibli.oss:kafka-plugin =0.0.1, =0.0.5, =1.3.0.release, =1.3.0.release,...

io.kermoss:reactive-business-flow (0.0.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.8.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - io.kermoss:reactive-business-flow 0.0.1.release Source cves: CVE-2026-41726...

com.github.eventasia:event-store (>=0.0.1.release, <=0.0.3.release), com.github.eventasia:eventasia-starter (>=0.0.4.release, <=0.0.10.release) +4 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.0.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:event-store =0.0.1.release, =0.0.4.release,...

org.springframework.integration:spring-integration-kafka (2.0.0.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.0.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.0.0.release Sour...

org.springframework.integration:spring-integration-kafka (2.1.0.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.1.0.release Sour...

com.github.eventasia:eventasia-stream-kafka (>=0.0.12.release, <=0.0.13.release), org.apereo.cas:cas-server-core-configuration-cloud-kafka (>=5.1.0-rc4, <=5.1.9) +1 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.eventasia:eventasia-stream-kafka =0.0.12.release, =5.1.0-rc4,...

org.springframework.cloud:spring-cloud-starter-bus-kafka (1.3.1.release), org.springframework.cloud:spring-cloud-stream-docs (chelsea.sr2) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.4.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-bus-kafka 1.3.1.release -...

org.springframework.integration:spring-integration-kafka (2.3.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.10.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.3.1.release...

org.springframework.integration:spring-integration-kafka (2.0.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.0.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.0.1.release Sour...