{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kafka-streams-1.1.0-4.1.2-4.2.0-4.2.1-4.3.0-4.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-111496"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kafka Streams (1.1.0-4.1.2, 4.2.0-4.2.1, 4.3.0-4.3.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Kafka Streams contains an integer overflow vulnerability in the PunctuationSchedule.next() method. The application fails to perform bounds checking when calculating the next punctuation time using record timestamps. An attacker can supply a record with a timestamp near Long.MAX_VALUE to trigger the overflow, causing the affected StreamThread to hang.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a denial of service condition for the specific stream processing application, as the affected StreamThread stops processing data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify and upgrade vulnerable Kafka Streams deployments to versions that include the fix for CVE-2026-111496. Refer to the official Apache Kafka security advisory for the specific corrected version releases.\u003c/p\u003e\n","date_modified":"2026-10-28T18:21:27Z","date_published":"2026-10-28T18:21:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-stream-hang/","summary":"An integer overflow vulnerability in Apache Kafka Streams allows an attacker to cause a StreamThread hang by supplying a record with a near-maximum timestamp.","title":"Apache Kafka: Kafka Streams denial of service via integer overflow (CVE-2026-111496)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-stream-hang/"}],"language":"en","title":"CraftedSignal Threat Feed - Kafka Streams (1.1.0-4.1.2, 4.2.0-4.2.1, 4.3.0-4.3.1)","version":"https://jsonfeed.org/version/1.1"}