SB2026083153 - Multiple vulnerabilities in Spring for Apache Kafka

Description

This security bulletin contains information about 3 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-41726)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in DelegatingDeserializer when processing records with user-controlled spring.kafka.serialization.selector header values. A remote user can send records with unique random selector header values to cause a denial of service.

Only deployments that explicitly configured DelegatingDeserializer are affected.

2) Input validation error (CVE-ID: CVE-2026-41727)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the retry topic infrastructure when processing user-controlled retry headers. A remote user can send a record with crafted retry headers to cause a denial of service.

The issue affects handling of the retry_topic-attempts and retry_topic_backoff-timestamp headers.

3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41731)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause resource exhaustion and other side effects by triggering deserialization of arbitrary JDK types.

The vulnerability exists due to improper control of deserialization in JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper when processing type headers against trusted packages. A remote attacker can supply crafted header values to cause resource exhaustion and other side effects by triggering deserialization of arbitrary JDK types.

The issue stems from trusted-package matching that used a prefix check, so trusting a package also trusted its subpackages.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-41726
• https://spring.io/security/cve-2026-41727
• https://spring.io/security/cve-2026-41731