|
ELS
< Back

CVE-2026-41726

Updated on 10 Jun 2026

Severity

6.5 Medium severity

Details

CVSS score
6.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

When an application opts into DelegatingDeserializer, a producer can grow the consumer’s heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError. Only deployments that explicitly configured DelegatingDeserializer are affected.

Details

Affected product:
Spring
Affected packages:
Spring Integration @ 5.5.19 (+390 more)