CVE-2026-59317

In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

State: Published
Severity: 6.5 Medium
Published: Aug 27, 2026
Updated: Aug 28, 2026
Reserved: Jul 4, 2026

Read the record on cve.org

Description

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	vmware

Weaknesses

CWE-1284 Improper Validation of Specified Quantity in Input

Affected Products

Product	Versions
Spring for Apache KafkaSpring	4.1.0Affected 4.0.0 through 4.0.6Affected 3.0.0 through 3.3.16Affected 2.9.0 through 2.9.14Affected 2.8.12 and earlierAffected

References

https://spring.io/security/cve-2026-59317

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.