6.5
Moyenne
CVE-2026-59317 DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord…
Description
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring For Apache Kafka | 4.1.0 | Pas de correctif indiqué |
| Spring For Apache Kafka 4.0 | 4.0.0 → 4.0.6 | Pas de correctif indiqué |
| Spring For Apache Kafka 3.0 | 3.0.0 → 3.3.16 | Pas de correctif indiqué |
| Spring For Apache Kafka 2.9 | 2.9.0 → 2.9.14 | Pas de correctif indiqué |
| Spring For Apache Kafka 2.8 | premières → 2.8.12 | Pas de correctif indiqué |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring For Apache Kafka
Les 6 CVE de Spring For Apache Kafka →
CVE-2026-59278
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list
6.5
Moyenne
CVE-2026-41731
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using…
8.1
Élevée
CVE-2026-41727
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on…
6.5
Moyenne
CVE-2026-41726
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending…
6.5
Moyenne