A vulnerability in Spring for Apache Kafka's DeadLetterPublishingRecovererFactory lacks proper header validation, which can be exploited to create a poison-pill loop leading to denial of service. The advisory page content itself is largely inaccessible, showing only a cookie consent notice, but the title identifies a specific CVE affecting Kafka error-handling recovery logic.
Questions this post answers
What is the poison-pill loop vulnerability in Spring for Apache Kafka's DeadLetterPublishingRecovererFactory?
Missing header validation in DeadLetterPublishingRecovererFactory allows a malformed or repeatedly failing message to be sent to the dead letter topic without proper checks, causing it to be reprocessed in a loop. This poison-pill behavior can exhaust consumer resources and result in a denial of service for applications relying on this recovery mechanism. Teams running Spring Kafka consumers can track this advisory on daily.dev before patching their recoverer configuration.