Spring Kafka CVE-2026-59317

Exploitation requires the target application to have opted into Spring Kafka's non-blocking retry or dead-letter queue infrastructure by instantiating DeadLetterPublishingRecovererFactory - this is not active in all Spring Kafka deployments and must be explicitly configured. The attacker must hold Kafka producer access to at least one topic monitored by the vulnerable consumer, which under typical Kafka security models means valid credentials or a client certificate recognized by the broker (PR:L per CVSS); in environments with no Kafka authentication or open ACLs, this barrier is effectively absent. The malformed header is processed only when the consumer invokes the recovery path - either by sending a message that naturally fails processing or by injecting the header directly on any ConsumerRecord destined for that topic. Exploitation is strictly limited to availability (consumer crash or hang); there is no confidentiality or integrity impact per the CVSS vector (C:N/I:N). Strong Kafka broker ACLs restricting producer identity to known internal services are the primary factor limiting exploitation in hardened environments.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a 6.5 Medium score, accurately reflecting that exploitation is network-reachable with low complexity but gated behind some level of Kafka producer access (PR:L). Real-world risk is further conditional on the deployment actively using DeadLetterPublishingRecovererFactory - applications relying only on standard Kafka consumers without the retry/DLQ subsystem are entirely unaffected, narrowing the practical attack surface. EPSS data is absent from available intelligence, and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation. No POC code has been identified; these two signals together place the immediate exploitation likelihood at low-to-moderate. However, Kafka environments with permissive broker ACLs or open topic write access could effectively reduce PR:L to PR:N in practice, elevating real-world risk beyond what the CVSS vector implies. The conflicting 'Information Disclosure' source tag should be disregarded - CVSS and the description are internally consistent on an availability-only impact.

An attacker with Kafka producer credentials - or operating from a network segment with permissive broker ACLs - publishes a ConsumerRecord to a topic consumed by a Spring Kafka application configured with the non-blocking retry/DLQ feature. The record carries a retry_topic-original-timestamp header containing several megabytes of arbitrary bytes. When message processing fails and DeadLetterPublishingRecovererFactory attempts to parse the timestamp, Java's BigInteger constructor allocates memory proportional to the header size, exhausting the consumer JVM heap and triggering an OutOfMemoryError that crashes or permanently stalls the consumer, halting all message processing on that consumer instance.