Advisoriesby IbisVMwareCVE-2026-59317
VMware Spring for Apache Kafka: improper quantity validation
No fix yet
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Spring for Apache Kafka Product | <= 4.1.0 | No fix yet |
| >= 4.0.0, <= 4.0.6 | No fix yet | |
| >= 3.0.0, <= 3.3.16 | No fix yet | |
| >= 2.9.0, <= 2.9.14 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-1284