CVE-2026-124465

Name of the Vulnerable Software and Affected Versions Trendyol kafka-konsumer versions 2.3.3 through 2.6.17

Description A denial of service issue exists in batch consumer.go that triggers a panic when a single record exceeds the MessageGroupByteSizeLimit. An attacker with permissions to produce messages to the consumed topic can publish an oversized record, which terminates the consumer before the offset is committed, resulting in a persistent crash loop.

Recommendations Update Trendyol kafka-konsumer to version 2.6.18 or later.