Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-111496— Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Quick assessment

Affected

Apache Software Foundation Apache Kafka

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kafka Streams 从记录的 timestamp（时间戳）推导其流时间时钟。在计算下一个标点（punctuation）时间时，采用公式，但未执行溢出检查。若某条记录的时间戳等于或接近，则流时间会被推进至该值，导致下一个流时间标点发生整数溢出，变为负数。随后，会将该负时间重新入队，并在持有锁的情况下无限循环处理该时间，致使停滞。影响：单条记录即可触发此问题。受影响的将停止处理；由于该记录仍保留在主题（topic）中，重启后挂起状态会再次出现。若应用的所有分区均受影响，整个应用将无响应。此问题仅

AI Predicted 6.5 Difficulty: Moderate Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Kafka	`1.1.0≤ 4.1.2`	affected
		`4.2.0≤ 4.2.1`	affected
		`4.3.0≤ 4.3.1`	affected

Updated Oct 29, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Source: CVE Program / CVE List V5

Vulnerability Description

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread. Impact: A single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed. Mitigation: Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them. Resolution: From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

整数溢出或超界折返

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Kafka	1.1.0 ~ 4.1.2	-

II. Public POCs for CVE-2026-111496

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111496

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-111496

Same Patch Batch · Apache Software Foundation · 2026-10-28 · 12 CVEs total

CVE-2026-114349		Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed r
CVE-2026-112375		Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterC
CVE-2026-116593		Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API
CVE-2026-115644		Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
CVE-2026-111551		Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded me
CVE-2026-111115		Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexibl
CVE-2026-111108		Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated
CVE-2026-111073		Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size lim
CVE-2026-110985		Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when t
CVE-2026-110952		Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEA
CVE-2026-83525		Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated

IV. Related Vulnerabilities

Same product: Apache Kafka

Same vendor: Apache Software Foundation

Same weakness: CWE-190