CVE-2026-59317

Received Received - Intake

DeadLetterPublishingRecovererFactory Timestamp Header Parsing Flaw

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59317

Affected Vendors & Products

Vendor	Product	Version / Range
spring	apache_kafka	From 4.0.0 (inc) to 4.0.6 (inc)
spring	apache_kafka	4.1.0
spring	apache_kafka	to 4.0.6 (inc)
spring	apache_kafka	From 3.0.0 (inc) to 3.3.16 (inc)
spring	apache_kafka	From 2.9.0 (inc) to 2.9.14 (inc)
spring	apache_kafka	to 2.8.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in Spring for Apache Kafka involves the DeadLetterPublishingRecovererFactory component which fails to validate the retry_topic-original-timestamp header. An attacker with write access to a Kafka topic can send a malformed header, such as a zero-length byte array, causing a NumberFormatException during recovery. This leads to an infinite loop where the system repeatedly tries to process the same message, stalling partition consumption and causing a denial of service.

Detection Guidance

Monitor Kafka consumer logs for repeated NumberFormatException errors during dead-letter processing. Check for stalled partition consumption where offsets are not advancing despite repeated processing attempts.

Impact Analysis

If exploited, this vulnerability can cause your Kafka consumers to stall indefinitely, preventing them from processing messages. This results in a denial of service where your application cannot handle incoming data, potentially disrupting services that rely on Kafka for messaging or event processing.

Mitigation Strategies

Upgrade to fixed versions: 4.1.1 (OSS), 4.1.0.1 (Enterprise), 4.0.7 (OSS), 4.0.6.1 (Enterprise), 3.3.17 (Enterprise), 2.9.15 (Enterprise), or 2.8.13 (Enterprise). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70