CyberRota Analysis
AI-GeneratedThe vulnerability exists in the DeadLetterPublishingRecovererFactory component of Spring for Apache Kafka, which improperly processes the retry_topic-original-timestamp header from inbound ConsumerRecords, allowing attackers to exploit the lack of length or format validation. This could lead to potential denial-of-service conditions or unexpected application behavior. Organizations using affected versions of Spring for Apache Kafka should prioritize patching to mitigate the risk associated with this vulnerability.
Original NVD Description
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)