CVE-2026-41726 Overview
CVE-2026-41726 is an unbounded resource allocation vulnerability [CWE-770] in Spring for Apache Kafka. When an application opts into the DelegatingDeserializer, a malicious or misbehaving producer can grow the consumer's heap without bound. The attack sends Kafka records containing unique random values in the spring.kafka.serialization.selector header. The consumer caches each unique selector value, eventually triggering garbage collection thrash and an OutOfMemoryError. The flaw enables a denial of service condition against any Spring Kafka consumer that has enabled delegating deserialization.
Critical Impact
Authenticated network attackers with producer access can exhaust consumer JVM heap memory, causing application crashes and service disruption.
Affected Products
- Spring for Apache Kafka 4.0.0 through 4.0.5
- Spring for Apache Kafka 3.3.0 through 3.3.15 and 3.2.0 through 3.2.13
- Spring for Apache Kafka 2.9.0 through 2.9.13 and 2.8.0 through 2.8.11
Discovery Timeline
- 2026-06-10 - CVE-2026-41726 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-41726
Vulnerability Analysis
The vulnerability resides in the DelegatingDeserializer component of Spring for Apache Kafka. This deserializer selects a delegate deserializer at runtime based on the value of the spring.kafka.serialization.selector Kafka record header. To avoid repeated lookups, the deserializer caches mappings between selector values and resolved delegate instances.
The cache does not enforce a maximum size or eviction policy. A producer that sets a unique random selector header on every record forces the consumer to add a new cache entry per message. Over time the cache grows until the JVM heap is exhausted.
The impact is service availability. Confidentiality and integrity are not affected, but the consumer process becomes unresponsive once garbage collection cannot reclaim sufficient memory.
Root Cause
The root cause is missing bounds on a runtime cache keyed by attacker-controlled input [CWE-770]. The DelegatingDeserializer treats every distinct selector header value as a legitimate key without validating it against an expected allow-list or enforcing a maximum cache size.
Attack Vector
Exploitation requires the attacker to publish records to a Kafka topic consumed by a vulnerable Spring Kafka application that has opted into DelegatingDeserializer. The attacker generates unique random strings for the spring.kafka.serialization.selector header on each record. Because the attack requires producer-level access to the broker, low privileges are needed, but no user interaction is required. Refer to the Spring Security Advisory CVE-2026-41726 for vendor analysis.
Detection Methods for CVE-2026-41726
Indicators of Compromise
- Steadily increasing JVM heap usage on Spring Kafka consumer processes with no corresponding growth in legitimate message volume.
- Frequent full garbage collection cycles followed by java.lang.OutOfMemoryError: Java heap space in consumer logs.
- High cardinality of distinct values observed in the spring.kafka.serialization.selector Kafka record header.
Detection Strategies
- Instrument consumers with JVM metrics (heap, GC pause time) and alert on sustained upward heap trends across restarts.
- Sample inbound Kafka headers and flag topics where the cardinality of spring.kafka.serialization.selector exceeds the count of registered delegates.
- Correlate consumer OOM events with the producing client IDs and principals that sent records immediately preceding the crash.
Monitoring Recommendations
- Forward JVM and Kafka client metrics to a centralized observability or SIEM platform for anomaly detection.
- Enable broker-side audit logging of producer principals and client IDs to attribute abusive traffic.
- Track the size of internal deserializer caches if the application exposes them via Micrometer or JMX.
How to Mitigate CVE-2026-41726
Immediate Actions Required
- Upgrade Spring for Apache Kafka to a fixed release as published in the Spring Security Advisory CVE-2026-41726.
- Inventory all services using DelegatingDeserializer and prioritize patching internet-adjacent or multi-tenant Kafka consumers.
- Restrict Kafka producer ACLs so only trusted principals can write to topics consumed by Spring Kafka applications.
Patch Information
VMware/Spring has released fixed versions addressing the unbounded cache growth in DelegatingDeserializer. Consult the Spring Security Advisory CVE-2026-41726 for the specific patched versions corresponding to each affected branch (4.0.x, 3.3.x, 3.2.x, 2.9.x, 2.8.x).
Workarounds
- If patching is delayed, stop using DelegatingDeserializer and configure a single fixed deserializer for the topic.
- Implement a custom deserializer wrapper that validates the spring.kafka.serialization.selector header against an allow-list of expected values before delegating.
- Enforce strict Kafka authorization and quotas to limit which producers can write to consumer topics and at what rate.
# Configuration example - enforce an allow-list and disable DelegatingDeserializer
spring.kafka.consumer.value-deserializer=org.apache.kafka.common.serialization.StringDeserializer
# Restrict producer ACLs at the broker
kafka-acls.sh --bootstrap-server broker:9092 \
--add --allow-principal User:trusted-producer \
--producer --topic secured-topic
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
