CVE-2026-59317: CWE-1284 Improper Validation of Specified Quantity in Input in Spring Spring for Apache Kafka

The vulnerability involves improper validation of the retry_topic-original-timestamp header in the DeadLetterPublishingRecovererFactory class of Spring for Apache Kafka. The header's raw bytes are passed directly to the BigInteger constructor without checking length or format, which can cause unexpected behavior or denial of service conditions. Affected versions include 2.8.12 and earlier, 2.9.0 through 2.9.14, 3.0.0 through 3.3.16, 4.0.0 through 4.0.6, and 4.1.0. The CVSS v3.1 score is 6.5 (medium severity) with an attack vector of network, low attack complexity, requiring low privileges and no user interaction, impacting availability only. No known exploits are reported and no vendor advisory or patch is currently available.

The vulnerability can lead to availability impact due to improper validation of input data, potentially causing application errors or denial of service in Spring for Apache Kafka environments processing affected headers. Confidentiality and integrity are not impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor vendor communications for updates and consider mitigating exposure by validating or filtering input headers if possible in their environment.