CVE-2026-41727 is an improper input validation vulnerability (CWE-20) in Spring for Apache Kafka's retry topic infrastructure. The component does not sufficiently validate user-controlled header values, specifically the retry_topic-attempts header. An attacker controlling a producer can craft this header with an out-of-range attempt count, leading the retry topic router to incorrectly determine the message's retry sequence position. This can result in disruption of message processing, impacting availability. The affected versions include Spring for Apache Kafka 2.8.0 through 2.8.11, 2.9.0 through 2.9.13, 3.2.0 through 3.2.13, 3.3.0 through 3.3.15, and 4.0.0 through 4.0.5. There is no vendor advisory or patch information provided at this time.

The vulnerability allows a producer to manipulate the retry_topic-attempts header to supply an out-of-range attempt count, causing the retry topic router to misidentify the message's retry sequence position. This misidentification can disrupt the intended retry logic, potentially leading to message processing failures or delays, impacting the availability of the messaging system. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting producer access to trusted sources to prevent malicious header manipulation. Monitor vendor channels for updates regarding patches or official mitigations.