CVE-2026-59317

Analyzed Analyzed - Analysis Complete

DeadLetterPublishingRecovererFactory Timestamp Header Parsing Flaw

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59317

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_for_apache_kafka	to 2.8.12 (inc)
vmware	spring_for_apache_kafka	From 2.9.0 (inc) to 2.9.14 (inc)
vmware	spring_for_apache_kafka	From 3.0.0 (inc) to 3.3.16 (inc)
vmware	spring_for_apache_kafka	From 4.0.0 (inc) to 4.0.7 (exc)
vmware	spring_for_apache_kafka	From 4.1.0 (inc) to 4.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability in Spring for Apache Kafka involves the DeadLetterPublishingRecovererFactory component which fails to validate the retry_topic-original-timestamp header. An attacker with write access to a Kafka topic can send a malformed header, such as a zero-length byte array, causing a NumberFormatException during recovery. This leads to an infinite loop where the system repeatedly tries to process the same message, stalling partition consumption and causing a denial of service.

Detection Guidance

Monitor Kafka consumer logs for repeated NumberFormatException errors during dead-letter processing. Check for stalled partition consumption where offsets are not advancing despite repeated processing attempts.

Impact Analysis

If exploited, this vulnerability can cause your Kafka consumers to stall indefinitely, preventing them from processing messages. This results in a denial of service where your application cannot handle incoming data, potentially disrupting services that rely on Kafka for messaging or event processing.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt data processing. A stalled Kafka partition may prevent timely handling of personal or health data, potentially violating processing time requirements under GDPR Article 5 or HIPAA Security Rule integrity principles.

Mitigation Strategies

Upgrade to fixed versions: 4.1.1 (OSS), 4.1.0.1 (Enterprise), 4.0.7 (OSS), 4.0.6.1 (Enterprise), 3.3.17 (Enterprise), 2.9.15 (Enterprise), or 2.8.13 (Enterprise). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70