CVE-2026-59317
MediumCVSS 6.5Summary
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Affects Spring for Apache Kafka versions 4.1.0, 4.0.0-4.0.6, 3.0.0-3.3.16, 2.9.0-2.9.14, and 2.8.12 and earlier.
Risk Assessment
An attacker can supply a malicious header that causes an unexpected exception or excessive resource consumption, leading to application crash or DoS. This may disrupt message processing and affect service availability.
Recommendation
It is recommended to upgrade Spring for Apache Kafka to a patched version. Also consider validating headers before use in the application.
Original NVD description (English source)
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier