Kafka Streams (1.1.0-4.1.2, 4.2.0-4.2.1, 4.3.0-4.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kafka-streams-1.1.0-4.1.2-4.2.0-4.2.1-4.3.0-4.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 18:21:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Kafka: Kafka Streams denial of service via integer overflow (CVE-2026-111496)https://feed.craftedsignal.io/briefs/2026-10-apache-kafka-stream-hang/Wed, 28 Oct 2026 18:21:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-kafka-stream-hang/An integer overflow vulnerability in Apache Kafka Streams allows an attacker to cause a StreamThread hang by supplying a record with a near-maximum timestamp.Apache Kafka Streams contains an integer overflow vulnerability in the PunctuationSchedule.next() method. The application fails to perform bounds checking when calculating the next punctuation time using record timestamps. An attacker can supply a record with a timestamp near Long.MAX_VALUE to trigger the overflow, causing the affected StreamThread to hang.

Impact

Successful exploitation leads to a denial of service condition for the specific stream processing application, as the affected StreamThread stops processing data.

Recommendation

Identify and upgrade vulnerable Kafka Streams deployments to versions that include the fix for CVE-2026-111496. Refer to the official Apache Kafka security advisory for the specific corrected version releases.

]]>lowadvisory