Input validation error in Spring for Apache Kafka - CVE-2026-59317
Published: August 28, 2026
Vulnerability identifier: #VU146209
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59317
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in DeadLetterPublishingRecovererFactory when processing the retry_topic-original-timestamp header from an inbound ConsumerRecord during recovery. A remote user can send a malformed header value to cause a denial of service.
Exploitation can cause dead-letter publication to abort, after which the error handler seeks back to the failed offset and repeats the cycle indefinitely, stalling partition consumption.
Affected software
Spring for Apache Kafka
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59317
Install security update from vendor's website.
Spring for Apache Kafka - addressed in versions 2.8.13, 2.9.15, 3.3.17, 4.0.6.1, 4.0.7, 4.1.0.1, 4.1.1
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19