How severe is CVE-2026-59317?

CVE-2026-59317 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-59317 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-59317?

CVE-2026-59317 affects Vmware Spring For Apache Kafka. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-59317?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-59317 published?

CVE-2026-59317 was published on 2026-08-27 and last updated on 2026-09-04.

CVE-2026-59317

CVE-2026-59317 is a medium-severity vulnerability in Vmware Spring For Apache Kafka with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1284.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1284
Affected product: Vmware Spring For Apache Kafka
Published: 2026-08-27
Last modified: 2026-09-04

Description

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

Frequently asked questions

What is CVE-2026-59317?: DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
How severe is CVE-2026-59317?: CVE-2026-59317 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-59317 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-59317?: CVE-2026-59317 affects Vmware Spring For Apache Kafka. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-59317?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-59317 published?: CVE-2026-59317 was published on 2026-08-27 and last updated on 2026-09-04.

References

https://spring.io/security/cve-2026-59317

Affected products (1)

cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*

More vulnerabilities in Vmware Spring For Apache Kafka

CVE-2026-41731 — High (CVSS 8.1): JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a…
CVE-2026-59278 — Medium (CVSS 6.5): JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these…
CVE-2026-41727 — Medium (CVSS 6.5): Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on…
CVE-2026-41726 — Medium (CVSS 6.5): When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending…
CVE-2023-34040 — Medium (CVSS 5.3): In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector…

All CVEs affecting Vmware Spring For Apache Kafka →

Other CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerabilities

CVE-2026-81779 — Critical (CVSS 10.0): Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software…
CVE-2026-49777 — Critical (CVSS 10.0): Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for…
CVE-2024-8887 — Critical (CVSS 10.0): CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with…
CVE-2022-20699 — Critical (CVSS 10.0): Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker…
CVE-2021-21960 — Critical (CVSS 10.0): A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect…
CVE-2021-21951 — Critical (CVSS 10.0): An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the…

Browse all CWE-1284 (Improper Validation of Specified Quantity in Input) vulnerabilities →