CVE-2026-59317
published 2026-08-27CVE-2026-59317: DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
35.3th percentile
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_for_apache_kafka | <= 2.8.12 | — |
| spring | spring_for_apache_kafka | — | — |
| spring | spring_for_apache_kafka | 2.9.0 – 2.9.14 | — |
| spring | spring_for_apache_kafka | 3.0.0 – 3.3.16 | — |
| spring | spring_for_apache_kafka | 4.0.0 – 4.0.6 | — |
| vmware | spring_for_apache_kafka | <= 2.8.12 | — |
| vmware | spring_for_apache_kafka | 2.9.0 – 2.9.14 | — |
| vmware | spring_for_apache_kafka | 3.0.0 – 3.3.16 | — |
| vmware | spring_for_apache_kafka | >= 4.0.0 < 4.0.7 | 4.0.7 |
| vmware | spring_for_apache_kafka | >= 4.1.0 < 4.1.1 | 4.1.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length o
ghsa_unreviewed·2026-08-27
CVE-2026-59317 [MEDIUM] CWE-1284 DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length o
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
Red Hat
org.springframework.kafka/spring-kafka: Spring for Apache Kafka: Denial of Service via missing header validation
vendor_redhat·2026-08-27·CVSS 6.5
CVE-2026-59317 [MEDIUM] CWE-1284 org.springframework.kafka/spring-kafka: Spring for Apache Kafka: Denial of Service via missing header validation
org.springframework.kafka/spring-kafka: Spring for Apache Kafka: Denial of Service via missing header validation
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
A flaw was found in Spring for Apache Kafka. The DeadLetterPublishingRecovererFactory component does not properly validate the retry_topic-original-timestamp header. A remote attacker can exploit this by sending a specially crafted message with a malformed header, leading to
No detection rules found.
No public exploits indexed.
2026-08-27
Published