Description

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence. Separately, the retry_topic_backoff-timestamp header was accepted without bounds checking, meaning a forged timestamp could instruct the backoff manager to impose an arbitrarily long pause, stalling the listener far beyond any intended retry window.

Affected Spring Products and Versions

Spring for Apache Kafka:

• 4.0.0 - 4.0.5
• 3.3.0 - 3.3.15
• 3.2.0 - 3.2.13
• 2.9.0 - 2.9.13
• 2.8.0 - 2.8.11

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was discovered internally.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

• 2026-06-09: Initial vulnerability report published.