Skip to content
OpenAdvisories

Package · Maven

org.springframework.kafka:spring-kafka

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-41727

    In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior

    Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry …

    Spring Spring for Apache Kafka org.springframework.kafka:spring-kafka Maven
  • Medium 6.5
    CVE-2026-41726

    In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

    When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected ve…

    Spring Spring for Apache Kafka org.springframework.kafka:spring-kafka Maven
  • Medium 5.3
    CVE-2023-34040 Public exploit

    Java Deserialization vulnerability in Spring-Kafka When Improperly Configured

    In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the dese…

    Spring Spring for Apache Kafka org.springframework.kafka:spring-kafka Maven