Apache Kafka: Kafka Streams denial of service via integer overflow (CVE-2026-111496)
An integer overflow vulnerability in Apache Kafka Streams allows an attacker to cause a StreamThread hang by supplying a record with a near-maximum timestamp.
CVE search metadata
CVE search record: CVE-2026-111496. KEV: no. Product: Kafka Streams (1.1.0-4.1.2, 4.2.0-4.2.1, 4.3.0-4.3.1). Brief: Apache Kafka: Kafka Streams denial of service via integer overflow (CVE-2026-111496). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-stream-hang/
Triage facts
Revision 1- Applicability
- Kafka Streams (1.1.0-4.1.2, 4.2.0-4.2.1, 4.3.0-4.3.1)
- Evidence
- Unknown
- Severity
- Low
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 18:21 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Apache Kafka Streams contains an integer overflow vulnerability in the PunctuationSchedule.next() method. The application fails to perform bounds checking when calculating the next punctuation time using record timestamps. An attacker can supply a record with a timestamp near Long.MAX_VALUE to trigger the overflow, causing the affected StreamThread to hang.
Impact
Successful exploitation leads to a denial of service condition for the specific stream processing application, as the affected StreamThread stops processing data.
Recommendation
Identify and upgrade vulnerable Kafka Streams deployments to versions that include the fix for CVE-2026-111496. Refer to the official Apache Kafka security advisory for the specific corrected version releases.
Mitigations
Upgrade Apache Kafka Streams to the version specified in the vendor patch advisory
CVE-2026-111496