EUVD-2026-67199
GHSA-v648-fvf7-jrg2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Kafka is network-reachable (AV:N); producing to a topic requires credentials (PR:L); heap exhaustion from unbounded BigInteger allocation causes high availability impact with no confidentiality or integrity effects.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
AnalysisAI
Denial-of-service in Spring for Apache Kafka's DeadLetterPublishingRecovererFactory exposes consumer JVMs across all supported branches (2.8.x through 4.1.0) to crash or hang when processing messages with a crafted retry_topic-original-timestamp header. An authenticated Kafka producer can inject a ConsumerRecord carrying an oversized or malformed header byte array, which is passed without any length or format validation directly to Java's BigInteger(byte[]) constructor, triggering heap memory exhaustion or an unhandled exception that disrupts message consumption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to have opted into Spring Kafka's non-blocking retry or dead-letter queue infrastructure by instantiating `DeadLetterPublishingRecovererFactory` - this is not active in all Spring Kafka deployments and must be explicitly configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a 6.5 Medium score, accurately reflecting that exploitation is network-reachable with low complexity but gated behind some level of Kafka producer access (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The vendor advisory at https://spring.io/security/cve-2026-59317 should be consulted directly for exact patched release versions - specific fix version numbers are not present in the available intelligence data and have not been independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today