Spring for Apache Kafka fails to validate user-controlled retry_topic-attempts header values, allowing a producer to supply an out-of-range retry attempt count. The malformed header misleads the retry topic router into incorrectly determining a message's position in the retry sequence, potentially causing messages to be lost, misdelivered, or processed out of order. This flaw is a classic input validation weakness (CWE‑20).

Spring for Apache Kafka versions 4.0.0 through 4.0.5, 3.3.0 through 3.3.15, 3.2.0 through 3.2.13, 2.9.0 through 2.9.13, and 2.8.0 through 2.8.11 are impacted.

The vulnerability has a CVSS score of 6.5 and is not listed in CISA KEV, with no EPSS value available. A likely attack vector is a client with permission to produce messages to Kafka; the attacker can craft a message containing a forged retry_topic-attempts header to subvert retry routing. Because the exploit requires only a producer role, it is executable by any entity able to send messages to the target Kafka cluster, making the risk moderate but operable in environments where producer access is not tightly constrained.