Medium severity · published Aug 27, 2026
CVE-2026-59317
In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring for Apache Kafka · Spring
4.1.0; 4.0.0 through 4.0.6; 3.0.0 through 3.3.16; 2.9.0 through 2.9.14; through 2.8.12 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59317
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59317
Vendor Advisory
https://spring.io/security/cve-2026-59317
More from Spring for Apache Kafka
8.1
CVE-2026-41731
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
6.5
CVE-2026-59278
In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
6.5
CVE-2026-41727
In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
6.5
CVE-2026-41726
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header