This vulnerability (CVE-2026-41726) in Spring for Apache Kafka arises from the DelegatingDeserializer feature, which allows a producer to cause uncontrolled heap memory growth in the consumer by sending records with unique random spring.kafka.serialization.selector header values. This behavior leads to excessive resource consumption, causing garbage collection thrashing and potentially an OutOfMemoryError, resulting in denial of service. The affected versions include Spring for Apache Kafka 2.8.0 through 2.8.11, 2.9.0 through 2.9.13, 3.2.0 through 3.2.13, 3.3.0 through 3.3.15, and 4.0.0 through 4.0.5. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). There is no vendor advisory or patch information available at this time.

The vulnerability can cause denial of service by exhausting the consumer application's heap memory through unbounded allocation triggered by crafted Kafka records. This leads to garbage collection thrashing and eventual OutOfMemoryError, which can disrupt normal application operations and availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or avoiding the use of DelegatingDeserializer if feasible, or implement application-level controls to limit or validate the spring.kafka.serialization.selector header values to prevent unbounded resource consumption.