cyfenced.com →

[ CVE-2026-111496 · Published 28 Oct 2026 ]

Vulnerability in Apache Software Foundation Apache Kafka

Not scored yet EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread. Impact: A single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed. Mitigation: Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them. Resolution: From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1415

    Multiple vulnerabilities in Apache Kafka Translated from French

    Multiple vulnerabilities have been discovered in Apache Kafka. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

    CVE-2026-111551CVE-2026-111073CVE-2026-110952+9 more CVEs
  • BSI CERT-BundWID-SEC-2026-4221

    Apache Kafka: Multiple vulnerabilities Translated from German

    CVE-2026-110952CVE-2026-110985CVE-2026-116593+10 more CVEs

[ References ]References