CVE-2026-59317

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-59317	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::
	cpe:2.3:a:vmware:spring_for_apache_kafka::::::::

History

No history.

Information

Published : 2026-08-27 20:17

Updated : 2026-09-04 19:21

NVD link : CVE-2026-59317

Mitre link : CVE-2026-59317

CVE.ORG link : CVE-2026-59317

JSON object : View

Products Affected

vmware

spring_for_apache_kafka

CWE

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2026-59317", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59317", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T22:43:11.466449Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring for Apache Kafka", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "versionType": "custom", "lessThanOrEqual": "4.0.6"}, {"status": "affected", "version": "3.0.0", "versionType": "custom", "lessThanOrEqual": "3.3.16"}, {"status": "affected", "version": "2.9.0", "versionType": "custom", "lessThanOrEqual": "2.9.14"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.8.12"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-27T20:17:57.797", "references": [{"url": "https://spring.io/security/cve-2026-59317", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.\nSpring for Apache Kafka 4.1.0\nSpring for Apache Kafka 4.0.0 - 4.0.6\nSpring for Apache Kafka 3.0.0 - 3.3.16\nSpring for Apache Kafka 2.9.0 - 2.9.14\nSpring for Apache Kafka 2.8.12 and earlier"}], "lastModified": "2026-09-04T19:21:37.703", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "016DE9D6-D487-48B2-86E4-980BBC9FF6E0", "versionEndIncluding": "2.8.12"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F546CD92-9BF9-42F2-BBD4-4826EC77DC03", "versionEndIncluding": "2.9.14", "versionStartIncluding": "2.9.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA48B906-A5C4-4F00-B8C9-7BD3E25BA704", "versionEndIncluding": "3.3.16", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "154A2F14-56BC-420C-B945-2CD32FFDEEEA", "versionEndExcluding": "4.0.7", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4091643-9791-451E-A4C7-BC8CB03297E4", "versionEndExcluding": "4.1.1", "versionStartIncluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}