Uncontrolled Resource Consumption

🗓️ 13 Jun 2026 09:27:30Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 5 Views

DelegatingDeserializer in Spring for Apache Kafka allows OOM via unique selector header values causing heap exhaustion. Apache Kafka. Vulnerability type: uncontrolled resource consumption. Impact: excessive GC and OutOfMemoryError.

Reporter	Title	Published	Views	Family All 17
CNNVD	VMware Spring for Apache Kafka 安全漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41726	9 Jun 202623:48	–	cve
Cvelist	CVE-2026-41726 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header	9 Jun 202623:48	–	cvelist
EUVD	EUVD-2026-35903	10 Jun 202600:31	–	euvd
F5 Networks	K000162065: Spring Framework for Apache Kafka vulnerability CVE-2026-41726	3 Jul 202606:10	–	f5
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilites identified in open source libraries shipped with IBM Guardium Cryptography Manager (GCM)	27 Aug 202613:39	–	ibm
Github Security Blog	In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header	10 Jun 202600:31	–	github
NVD	CVE-2026-41726	10 Jun 202600:16	–	nvd
OSV	GHSA-XVFQ-4Q6Q-GXX7 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header	10 Jun 202600:31	–	osv
OSV	MINI-7QXH-4V87-X89X	5 Aug 202601:41	–	osv

Vulners

Node

springframework spring-kafkaRange4.0.0-M1–4.0.5java

springframework spring-kafkaRange1.0.0.M1–3.3.15java

Source	Link
github	www.github.com/spring-projects/spring-kafka/commit/ca2337ba789c5778a10197bda17a62915247ff6c
github	www.github.com/spring-projects/spring-kafka/commit/52754050db74d67b97711528c163bbe57978501d
spring-projects	www.spring-projects/spring-kafka
spring	www.spring.io/security/cve-2026-41726
github	www.github.com/spring-projects/spring-kafka/commit/de57592db3bed045c5b870f6bd527010589eca45
github	www.github.com/advisories/GHSA-xvfq-4q6q-gxx7

15 Aug 2026 04:54Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.16.5

EPSS0.00296

SSVC