GHSA-53w6-v7cv-fc9h

Suggest an improvement
Source
https://github.com/advisories/GHSA-53w6-v7cv-fc9h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-53w6-v7cv-fc9h/GHSA-53w6-v7cv-fc9h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-53w6-v7cv-fc9h
Aliases
Downstream
MINI (2)
Published
2026-06-10T00:31:52Z
Modified
2026-08-12T18:11:02Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation
Details

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.

Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.

Database specific 
{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-12T17:42:55Z",
    "nvd_published_at":  "2026-06-10T00:16:52Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.springframework.kafka:spring-kafka

Package

Name
org.springframework.kafka:spring-kafka
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.kafka/spring-kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.6

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5

Database specific

last_known_affected_version_range 
"<= 4.0.5"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-53w6-v7cv-fc9h/GHSA-53w6-v7cv-fc9h.json"
org.springframework.kafka:spring-kafka

Package

Name
org.springframework.kafka:spring-kafka
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.kafka/spring-kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.3.0
Fixed
3.3.16

Affected versions

3.*
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15

Database specific

last_known_affected_version_range 
"<= 3.3.15"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-53w6-v7cv-fc9h/GHSA-53w6-v7cv-fc9h.json"
org.springframework.kafka:spring-kafka

Package

Name
org.springframework.kafka:spring-kafka
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.kafka/spring-kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2.0
Last Affected
3.2.13

Affected versions

3.*
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-53w6-v7cv-fc9h/GHSA-53w6-v7cv-fc9h.json"
org.springframework.kafka:spring-kafka

Package

Name
org.springframework.kafka:spring-kafka
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.kafka/spring-kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.9.0
Last Affected
2.9.13

Affected versions

2.*
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.9.9
2.9.10
2.9.11
2.9.12
2.9.13

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-53w6-v7cv-fc9h/GHSA-53w6-v7cv-fc9h.json"
org.springframework.kafka:spring-kafka

Package

Name
org.springframework.kafka:spring-kafka
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.kafka/spring-kafka

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.8.11

Affected versions

1.*
1.0.0.RELEASE
1.0.1.RELEASE
1.0.2.RELEASE
1.0.3.RELEASE
1.0.4.RELEASE
1.0.5.RELEASE
1.0.6.RELEASE
1.1.0.RELEASE
1.1.1.RELEASE
1.1.2.RELEASE
1.1.3.RELEASE
1.1.4.RELEASE
1.1.5.RELEASE
1.1.6.RELEASE
1.1.7.RELEASE
1.1.8.RELEASE
1.2.0.RELEASE
1.2.1.RELEASE
1.2.2.RELEASE
1.2.3.RELEASE
1.3.0.RELEASE
1.3.1.RELEASE
1.3.2.RELEASE
1.3.3.RELEASE
1.3.4.RELEASE
1.3.5.RELEASE
1.3.6.RELEASE
1.3.7.RELEASE
1.3.8.RELEASE
1.3.9.RELEASE
1.3.10.RELEASE
1.3.11.RELEASE
2.*
2.0.0.RELEASE
2.0.1.RELEASE
2.0.2.RELEASE
2.0.3.RELEASE
2.0.4.RELEASE
2.0.5.RELEASE
2.0.6.RELEASE
2.0.7.RELEASE
2.0.8.RELEASE
2.1.0.RELEASE
2.1.1.RELEASE
2.1.2.RELEASE
2.1.3.RELEASE
2.1.4.RELEASE
2.1.5.RELEASE
2.1.6.RELEASE
2.1.7.RELEASE
2.1.8.RELEASE
2.1.9.RELEASE
2.1.10.RELEASE
2.1.11.RELEASE
2.1.12.RELEASE
2.1.13.RELEASE
2.1.14.RELEASE
2.2.0.RELEASE
2.2.1.RELEASE
2.2.2.RELEASE
2.2.3.RELEASE
2.2.4.RELEASE
2.2.5.RELEASE
2.2.6.RELEASE
2.2.7.RELEASE
2.2.8.RELEASE
2.2.9.RELEASE
2.2.10.RELEASE
2.2.11.RELEASE
2.2.12.RELEASE
2.2.13.RELEASE
2.2.14.RELEASE
2.2.15.RELEASE
2.3.0.RELEASE
2.3.1.RELEASE
2.3.2.RELEASE
2.3.3.RELEASE
2.3.4.RELEASE
2.3.5.RELEASE
2.3.6.RELEASE
2.3.7.RELEASE
2.3.8.RELEASE
2.3.9.RELEASE
2.3.10.RELEASE
2.3.11.RELEASE
2.3.12.RELEASE
2.3.13.RELEASE
2.3.14.RELEASE
2.4.0.RELEASE
2.4.1.RELEASE
2.4.2.RELEASE
2.4.3.RELEASE
2.4.4.RELEASE
2.4.5.RELEASE
2.4.6.RELEASE
2.4.7.RELEASE
2.4.8.RELEASE
2.4.9.RELEASE
2.4.10.RELEASE
2.4.11.RELEASE
2.4.12.RELEASE
2.4.13.RELEASE
2.5.0.RELEASE
2.5.1.RELEASE
2.5.2.RELEASE
2.5.3.RELEASE
2.5.4.RELEASE
2.5.5.RELEASE
2.5.6.RELEASE
2.5.7.RELEASE
2.5.8.RELEASE
2.5.9.RELEASE
2.5.10.RELEASE
2.5.11.RELEASE
2.5.12.RELEASE
2.5.13.RELEASE
2.5.14.RELEASE
2.5.15.RELEASE
2.5.16.RELEASE
2.5.17.RELEASE
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.10
2.6.11
2.6.12
2.6.13
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.7.13
2.7.14
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.8.10
2.8.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-53w6-v7cv-fc9h/GHSA-53w6-v7cv-fc9h.json"