« Back to list

CVE-2026-59317

Status: AnalyzedMedium (6.5)—

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Vmware — Spring FOR Apache Kafka

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-59317",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59317",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-28T22:43:11.466449Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring for Apache Kafka",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.0.6"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "3.3.16"
            },
            {
              "status": "affected",
              "version": "2.9.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.9.14"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.8.12"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-27T20:17:57.797",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-59317",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.\nSpring for Apache Kafka 4.1.0\nSpring for Apache Kafka 4.0.0 - 4.0.6\nSpring for Apache Kafka 3.0.0 - 3.3.16\nSpring for Apache Kafka 2.9.0 - 2.9.14\nSpring for Apache Kafka 2.8.12 and earlier"
    }
  ],
  "lastModified": "2026-09-04T19:21:37.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "016DE9D6-D487-48B2-86E4-980BBC9FF6E0",
              "versionEndIncluding": "2.8.12"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F546CD92-9BF9-42F2-BBD4-4826EC77DC03",
              "versionEndIncluding": "2.9.14",
              "versionStartIncluding": "2.9.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA48B906-A5C4-4F00-B8C9-7BD3E25BA704",
              "versionEndIncluding": "3.3.16",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "154A2F14-56BC-420C-B945-2CD32FFDEEEA",
              "versionEndExcluding": "4.0.7",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4091643-9791-451E-A4C7-BC8CB03297E4",
              "versionEndExcluding": "4.1.1",
              "versionStartIncluding": "4.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}