CVE-2026-59317 Security Details

CVE ID

CVE-2026-59317

CWE

CWE-1284

CVE Description

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Published

Aug 20, 2026

CVSS Score & Severity

7.1High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.420%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/kafka/retrytopic/DeadLetterPublishingRecovererFactory.getOriginaTimeStampHeader(Lorg/apache/kafka/clients/consumer/ConsumerRecord;)Lorg/apache/kafka/common/header/Header;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT