CVE-2026-59317: In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop
DeadLetterPublishingRecovererFactory reads the retrytopic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the affected Spring for Apache Kafka versions are exposed where DeadLetterPublishingRecovererFactory processes inbound ConsumerRecord instances carrying the retry_topic-original-timestamp header. The affected ranges are 4.1.0, 4.0.0 through 4.0.6, 3.0.0 through 3.3.16, 2.9.0 through 2.9.14, and 2.8.12 and earlier.
What does an attacker need to exploit the denial of service?
An attacker needs the ability to supply or influence an inbound Kafka ConsumerRecord with a retry_topic-original-timestamp header. The vulnerable code passes the header's raw value to BigInteger without validating its length or format, enabling a poison-pill loop.
What is the expected impact of successful exploitation?
Successful exploitation can cause denial of service. The reported CVSS vector indicates network reachability, low attack complexity, low privileges required, no user interaction, and impact limited to availability.