Executive brief
A vulnerability in Spring for Apache Kafka can allow an attacker to crash a Java application by exhausting its memory. By sending specially crafted messages with unique headers, an attacker can force the system to store an unlimited amount of data in its internal cache. This leads to severe performance degradation and eventually causes the application to stop responding.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) within the DelegatingDeserializer component of Spring for Apache Kafka. When this component is enabled, it maintains an internal delegate cache that uses the 'spring.kafka.serialization.selector' header value as a key. Because this cache is unbounded, a remote attacker with permissions to produce records can send messages with unique, random selector headers. This causes the heap to grow without limit, leading to excessive Garbage Collection (GC) overhead and an eventual OutOfMemoryError (OOM). Patches are available in versions 4.0.6 and 3.3.16.
Affected products
- Spring Spring for Apache Kafka 4.0.0 to 4.0.5, 3.3.0 to 3.3.15, 3.2.0 to 3.2.13, 2.9.0 to 2.9.13, 2.8.0 to 2.8.11
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory