Skip to content
fr Sign in
6.5 Medium

CVE-2026-59317 DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord…

Description

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Affected products and versions

Product Affected versions Fixed in
Spring For Apache Kafka 4.1.0 No fix stated
Spring For Apache Kafka 4.0 4.0.0 → 4.0.6 No fix stated
Spring For Apache Kafka 3.0 3.0.0 → 3.3.16 No fix stated
Spring For Apache Kafka 2.9 2.9.0 → 2.9.14 No fix stated
Spring For Apache Kafka 2.8 earliest → 2.8.12 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring For Apache Kafka

The 6 CVEs of Spring For Apache Kafka →
CVE-2026-59278 JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list 6.5 Medium CVE-2026-41731 JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using… 8.1 High CVE-2026-41727 Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on… 6.5 Medium CVE-2026-41726 When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending… 6.5 Medium
Track this CVE