CVE-2026-59317

6.5 mediumEPSS 0.4%

Medium (6.5) in vmware spring for apache kafka. EPSS 0.4% chance of exploitation in the next 30 days.

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-1284
Published: 2026-08-27
Modified: 2026-09-04
Record from: the NVD, synced 2026-10-19

Affected

vmware:spring_for_apache_kafka

References

https://spring.io/security/cve-2026-59317

Check your stack JSON