Executive brief
Spring for Apache Kafka's DeadLetterPublishingRecovererFactory fails to validate message headers before passing them to number parsing logic, allowing attackers to craft malicious Kafka messages that trigger resource exhaustion or code execution. An attacker with ability to produce messages to monitored Kafka topics can cause the application to crash or execute arbitrary code, disrupting message processing and potentially compromising the application.
Technical details
DeadLetterPublishingRecovererFactory reads the 'retry_topic-original-timestamp' header from inbound Kafka ConsumerRecord messages and passes its raw bytes directly to new BigInteger(header.value()) without validating length, format, or content. An attacker with network access to a monitored Kafka topic can send a crafted message with a malicious header value (e.g., an extremely large byte array or invalid format) that causes BigInteger to consume excessive memory or throw an unhandled exception. This results in denial of service through application crash or resource exhaustion. No authentication is required to produce messages to a Kafka topic if the broker is accessible. A fix is expected in patched versions of Spring for Apache Kafka.
Affected products
- Spring Spring for Apache Kafka 2.8.12 and earlier, 2.9.0–2.9.14, 3.0.0–3.3.16, 4.0.0–4.0.6, 4.1.0
Timeline
- 2026-08-27: disclosed