CVE-2026-111496

Name of the Vulnerable Software and Affected Versions Kafka Streams versions prior to 4.2.2 Kafka Streams versions prior to 4.3.2 Kafka Streams versions prior to 4.4.0

Description Kafka Streams derives its stream-time clock from record timestamps. The PunctuationSchedule.next() function computes the next punctuation time without an overflow check. If a record contains a timestamp at or near Long.MAX VALUE, the stream time advances to that value, causing the next stream-time punctuation to overflow into a negative time. Consequently, the PunctuationQueue re-queues that time and loops indefinitely while holding a lock, which stalls the StreamThread. A single record can cause the affected StreamThread to stop processing; since the record remains in the topic, the hang persists after a restart. If all partitions are affected, the application becomes unresponsive. This issue only affects the Streams application and not the brokers or the cluster. Exploitation requires write access to a source topic using stream-time punctuation and a broker that accepts the timestamp.

Recommendations Upgrade Kafka Streams to version 4.2.2. Upgrade Kafka Streams to version 4.3.2. Upgrade Kafka Streams to version 4.4.0. Keep log.message.timestamp.after.max.ms bounded on source topics. Restrict write access to source topics.