Overview
About vulnerability
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.
A Kafka producer with write access to a topic consumed by a @RetryableTopic listener can attach a malformed header (e.g. a zero-length byte array), causing a NumberFormatException in the destination resolver during recovery.
This aborts dead-letter publication, the error handler seeks back to the failed offset, and the cycle repeats indefinitely, stalling partition consumption.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Integration @ 5.5.19 (+390 more)