CVE-2026-41726mediumCWE-770

CVE-2026-41726: falha de média gravidade em Spring for Apache Kafka

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring for Apache Kafka+ Monitorar org.springframework.kafka:spring-kafka

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.3%
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Spring · Spring for Apache Kafka
CVEs relacionadas — Spring for Apache Kafka

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41731HIGHIn Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationEPSS 0.5%CVE-2026-59317MEDIUMIn Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopEPSS 0.4%CVE-2026-59278MEDIUMIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packagesEPSS 0.3%CVE-2026-41727MEDIUMIn Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorEPSS 0.2%