CVE-2026-41726: In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

June 10, 2026 (updated June 12, 2026)

When an application opts into DelegatingDeserializer, a producer can grow the consumer’s heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.

Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

References

github.com/advisories/GHSA-xvfq-4q6q-gxx7
github.com/spring-projects/spring-kafka/commit/ca2337ba789c5778a10197bda17a62915247ff6c
github.com/spring-projects/spring-kafka/issues/4489
nvd.nist.gov/vuln/detail/CVE-2026-41726
spring.io/security/cve-2026-41726

Code Behaviors & Features

Detect and mitigate CVE-2026-41726 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →