Junglewise Threat Intelligence

CVE-2026-41726: VMware Spring for Apache Kafka denial of service in DelegatingDeserializer

CVE-2026-41726 · Severity: medium · CVSS 6.5 · Published 2026-06-10

Technologies: VMware Spring for Apache Kafka. Vendors: Spring, VMware.

Executive brief

A vulnerability in Spring for Apache Kafka can allow an attacker to crash a Java application by exhausting its memory. By sending specially crafted messages with unique headers, an attacker can force the system to store an unlimited amount of data in its internal cache. This leads to severe performance degradation and eventually causes the application to stop responding.

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) within the DelegatingDeserializer component of Spring for Apache Kafka. When this component is enabled, it maintains an internal delegate cache that uses the 'spring.kafka.serialization.selector' header value as a key. Because this cache is unbounded, a remote attacker with permissions to produce records can send messages with unique, random selector headers. This causes the heap to grow without limit, leading to excessive Garbage Collection (GC) overhead and an eventual OutOfMemoryError (OOM). Patches are available in versions 4.0.6 and 3.3.16.

Affected products

  • Spring Spring for Apache Kafka 4.0.0 to 4.0.5, 3.3.0 to 3.3.15, 3.2.0 to 3.2.13, 2.9.0 to 2.9.13, 2.8.0 to 2.8.11

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: advisory

References

Related threats