Vulnerability Directory | CVE-2026-41726

Overview

Spring for Apache Kafka applies core Spring concepts to the development of Kafka-based messaging solutions, providing the KafkaTemplate, message-driven listener containers, and serialization support that Spring and Spring Boot applications use to produce and consume Apache Kafka records.

A medium-severity vulnerability (CVE-2026-41726) has been identified in Spring for Apache Kafka. When an application explicitly configures the DelegatingDeserializer, the deserializer selects a delegate based on the spring.kafka.serialization.selector header of each incoming record. In affected versions, every selector value that fails to resolve to a usable deserializer is cached permanently in an unbounded internal map. A producer who can send records to a topic the application consumes can therefore grow the consumer's heap without bound by sending records with unique, random selector header values, eventually causing garbage-collection thrash and an OutOfMemoryError that takes the consumer down.

Per OWASP, a denial-of-service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed; there are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resource-handling vulnerabilities, among others.

This issue affects versions >=2.7.0 <=2.7.14, >=2.8.0 <=2.8.11, >=2.9.0 <=2.9.13, >=3.1.0 <=3.1.10, >=3.2.0 <=3.2.13, >=3.3.0 <=3.3.15, and >=4.0.0 <=4.0.5, as well as older, unsupported versions, of Spring for Apache Kafka.

‍

Details

Module Info

Product: Spring for Apache Kafka
Affected packages: spring-kafka
Affected versions: >=2.7.0 <=2.7.14, >=2.8.0 <=2.8.11, >=2.9.0 <=2.9.13, >=3.1.0 <=3.1.10, >=3.2.0 <=3.2.13, >=3.3.0 <=3.3.15, >=4.0.0 <=4.0.5
GitHub repository: https://github.com/spring-projects/spring-kafka
Published packages: https://central.sonatype.com/artifact/org.springframework.kafka/spring-kafka
Package manager: Maven
Fixed in:
NES for Spring for Apache Kafka 2.7.x, 2.8.x, 2.9.x, 3.1.x, 3.2.x
Spring for Apache Kafka 3.3.16, 4.0.6 (OSS)

Vulnerability Info

DelegatingDeserializer lets a single Kafka consumer handle records of different types: each producer record carries a spring.kafka.serialization.selector header, and the deserializer uses that header value to look up the delegate Deserializer to apply. Delegates are held in a ConcurrentHashMap keyed by the selector string. When a record arrives whose selector is not already in the map, the trySerdes(String key) method attempts to resolve the selector as a class name and build a delegate for it via Serdes.serdeFrom(Class):

Deserializer<?> trySerdes(String key) {    try {        Class<?> clazz = ClassUtils.forName(key, ClassUtils.getDefaultClassLoader());        Serde<? extends Object> serdeFrom = Serdes.serdeFrom(clazz);        Deserializer<? extends Object> deserializer = serdeFrom.deserializer();        deserializer.configure(this.autoConfigs, this.forKeys);        this.delegates.put(key, deserializer);        return deserializer;    }    catch (IllegalStateException | ClassNotFoundException | LinkageError e) {        this.delegates.put(key, Serdes.serdeFrom(byte[].class).deserializer());        return null;    }}

‍The catch clause is the problem. Every failed lookup writes the attacker-supplied selector string into the delegates map as a ByteArrayDeserializer fallback. Because the map is an unbounded ConcurrentHashMap with no size limit and entries are never evicted, a stream of records carrying distinct selector strings grows the map without bound for the life of the consumer. Since the selector header is set by the producer, any party able to publish to a consumed topic controls the cache keys and can drive the consumer to heap exhaustion.

A secondary flaw in the same method compounds the impact: Serdes.serdeFrom(Class) throws IllegalArgumentException for class types it does not support, and that exception type was absent from the catch clause. A selector naming a real class that serdeFrom cannot handle caused the IllegalArgumentException to propagate out of deserialize(), so a consumer without a dead-letter topic could stall indefinitely on the offending offset.

The remediation stops caching failed lookups entirely and adds IllegalArgumentException to the catch clause, so unresolvable selectors fall back to raw byte[] handling without growing the delegates map or breaking the consumer. Only deployments that explicitly configure DelegatingDeserializer are affected.

This vulnerability was introduced in 2020 with Spring for Apache Kafka 2.5.

‍

Mitigation

Spring for Apache Kafka 3.3.x and 4.0.x receive the fix in the open-source releases 3.3.16 and 4.0.6; the 2.8.x, 2.9.x, and 3.2.x lines, along with older lines such as 2.7.x and 3.1.x, are past their open-source support window and have no publicly available fix. Users still running an affected open-source line that no longer receives free updates should not attempt to hand-patch the deserializer.

To remediate this issue, affected users have two recommended options:

Upgrade to a supported, fixed release of Spring for Apache Kafka (3.3.16 or 4.0.6).
Adopt HeroDevs Never-Ending Support (NES) for Spring for Apache Kafka, which provides a drop-in compatible build with this vulnerability fixed for release lines that are otherwise end-of-life, with no code changes required. Learn more about HeroDevs Never-Ending Support for Spring and request coverage at https://www.herodevs.com/support/spring-nes.

‍