What is CVE-2026-59317?

CVE-2026-59317 is a medium-severity vulnerability in Spring For Apache Kafka, classified under CWE-1284 IMPROPER VALIDATION OF SPECIFIED QUANTITY IN INPUT. CVSS score: 6.5/10. Published 2026-08-27.

How severe is CVE-2026-59317?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Spring For Apache Kafka

CVE-2026-59317

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Spring For Apache Kafka — versions 4.1.0

References

security@vmware.com

Frequently asked questions

What is CVE-2026-59317?: CVE-2026-59317 is a medium-severity vulnerability in Spring For Apache Kafka, classified under CWE-1284 IMPROPER VALIDATION OF SPECIFIED QUANTITY IN INPUT. CVSS score: 6.5/10. Published 2026-08-27.
How severe is CVE-2026-59317?: Medium severity. CVSS v3 base score is 6.5 out of 10.