Improper Input Validation in Spring for Apache Kafka by VMware
CVE-2026-59317

6.5MEDIUM

Key Information:

Vendor

Spring

Status
Spring For Apache Kafka
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59317?

The DeadLetterPublishingRecovererFactory component in Spring for Apache Kafka fails to properly validate the length and format of the retry_topic-original-timestamp header from an inbound ConsumerRecord. This oversight allows raw bytes to be passed directly to new BigInteger(header.value()), which could potentially lead to unexpected behavior or exploitation. Users of Spring for Apache Kafka should review the affected versions and apply the necessary updates to mitigate this issue.

Affected Version(s)

Spring for Apache Kafka 4.1.0

Spring for Apache Kafka 4.0.0 <= 4.0.6

Spring for Apache Kafka 3.0.0 <= 3.3.16

References

https://spring.io/security/cve-2026-59317

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.