---
id: CVE-2026-59317
title: >-
  DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp
  header from an inbound ConsumerRecord and passes its raw bytes directly to new
  BigInteger(header.value()) with no length or format validation.

  Spring for Apach…
summary: >-
  DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp
  header from an inbound ConsumerRecord and passes its raw bytes directly to new
  BigInteger(header.value()) with no length or format validation.

  Spring for Apach…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1284
published: '2026-08-27'
updated: '2026-08-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59317'
references:
  - url: 'https://spring.io/security/cve-2026-59317'
    label: security@vmware.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59317.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59317'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59317'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59317'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2525176'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.0042
epssPercentile: 0.33695
ingestedAt: '2026-08-29T21:42:35.973Z'
vendor: Red Hat
product: Red Hat Fuse 7
affected:
  - fuse 7
---

## Overview

DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59317.json)