AIKIDO-2026-644472
spring-kafka is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
spring-kafkaTL;DR
spring-kafka DeadLetterPublishingRecovererFactory parses retry_topic-original-timestamp with new BigInteger(header.value()) and no length check. A producer can attach a malformed header, throw NumberFormatException, and abort dead-letter publication. The error handler then seeks back to the same offset and the partition stalls. The patch validates the header before parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and @RetryableTopic listeners use DeadLetterPublishingRecovererFactory.
Background info
spring-kafka is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 4.0.6 and 4.1.0 - 4.1.0.
How to fix this
Upgrade the org.springframework.kafka:spring-kafka library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant