CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

As cited

Copy frozen at 2026-10-28 21:26 UTC (site build).

vulnerabilities

CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

CVE-2026-111496 is a low-severity integer overflow vulnerability in Apache Kafka Streams affecting versions 1.1.0 through 4.3.1. The flaw occurs in PunctuationSchedule.next() when processing records with timestamps near Long.MAX_VALUE, causing stream-time punctuation calculations to overflow without bounds checking. This can cause the StreamThread to hang.

Why it matters: Kafka Streams operators should patch affected versions to prevent application hangs that could disrupt stream processing pipelines and impact downstream consumers.

Source published

2026-10-28 17:36 UTC

First seen by Cybersecurity Tracker

2026-10-28 20:02 UTC