CVE-2026-59317Medium· 6.5▾ SunlitDeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apach…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
CVE-2026-80344High· 8.2org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination (CVE-2026-80344)
CVE-2026-45856High· 7.0kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
CVE-2026-103484High· 8.8IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.
CVE-2026-32665High· 7.5unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length (CVE-2026-32665)
CVE-2026-32936High· 7.5github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests (CVE-2026-32936)