CVE-2026-111496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111496", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-16T09:55:02.432Z", "datePublished": "2026-10-28T16:45:08.114Z", "dateUpdated": "2026-11-05T19:19:35.662Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:45:08.114Z"}, "title": "Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation", "problemTypes": [{"descriptions": [{"description": "CWE-190 Integer overflow or wraparound", "lang": "en", "cweId": "CWE-190", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-835 Loop with unreachable exit condition ('infinite loop')", "lang": "en", "cweId": "CWE-835", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka-streams", "versions": [{"status": "affected", "version": "1.1.0", "lessThanOrEqual": "4.1.2", "versionType": "semver"}, {"status": "affected", "version": "4.2.0", "lessThanOrEqual": "4.2.1", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThanOrEqual": "4.3.1", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.kafka:kafka-streams"}], "descriptions": [{"value": "Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()\u00a0computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no\u00a0overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that\u00a0value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then\u00a0re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record\u00a0stays in the topic the hang returns on restart; an application whose partitions are all affected\u00a0becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster.\u00a0Triggering it needs write access to a source topic whose topology uses stream-time punctuation,\u00a0and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by\u00a0default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers\u00a0or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep\u00a0log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with\u00a0overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is\u00a0re-queued only when its time moves forward.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()&nbsp;<span>computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no&nbsp;</span><span>overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that&nbsp;</span><span>value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then&nbsp;</span><span>re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.</span></div><br><div>Impact:</div><div>A single record is enough. The affected StreamThread stops processing, and because the record&nbsp;<span>stays in the topic the hang returns on restart; an application whose partitions are all affected&nbsp;</span><span>becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster.&nbsp;</span><span>Triggering it needs write access to a source topic whose topology uses stream-time punctuation,&nbsp;</span><span>and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by&nbsp;</span><span>default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers&nbsp;</span><span>or where that bound has been relaxed.</span></div><br><div>Mitigation:</div><div>Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep&nbsp;<span>log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.</span></div><br><div>Resolution:</div><div>From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with&nbsp;<span>overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is&nbsp;</span><span>re-queued only when its time moves forward.</span></div>"}]}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Mike Read (GitHub: Michael-JRead)", "type": "reporter"}, {"lang": "en", "value": "Matthias J. Sax <matthias@confluent.io>", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T20:06:55.726Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:19:30.610539Z", "id": "CVE-2026-111496", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:19:35.662Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T20:06:55.726Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-111496", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:19:30.610539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:19:18.146Z"}}], "cna": {"title": "Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Mike Read (GitHub: Michael-JRead)"}, {"lang": "en", "type": "remediation developer", "value": "Matthias J. Sax <matthias@confluent.io>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "versions": [{"status": "affected", "version": "1.1.0", "versionType": "semver", "lessThanOrEqual": "4.1.2"}, {"status": "affected", "version": "4.2.0", "versionType": "semver", "lessThanOrEqual": "4.2.1"}, {"status": "affected", "version": "4.3.0", "versionType": "semver", "lessThanOrEqual": "4.3.1"}], "packageURL": "pkg:maven/org.apache.kafka/kafka-streams", "packageName": "org.apache.kafka:kafka-streams", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()\u00a0computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no\u00a0overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that\u00a0value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then\u00a0re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record\u00a0stays in the topic the hang returns on restart; an application whose partitions are all affected\u00a0becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster.\u00a0Triggering it needs write access to a source topic whose topology uses stream-time punctuation,\u00a0and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by\u00a0default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers\u00a0or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep\u00a0log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with\u00a0overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is\u00a0re-queued only when its time moves forward.", "supportingMedia": [{"type": "text/html", "value": "<div>Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()&nbsp;<span>computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no&nbsp;</span><span>overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that&nbsp;</span><span>value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then&nbsp;</span><span>re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.</span></div><br><div>Impact:</div><div>A single record is enough. The affected StreamThread stops processing, and because the record&nbsp;<span>stays in the topic the hang returns on restart; an application whose partitions are all affected&nbsp;</span><span>becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster.&nbsp;</span><span>Triggering it needs write access to a source topic whose topology uses stream-time punctuation,&nbsp;</span><span>and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by&nbsp;</span><span>default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers&nbsp;</span><span>or where that bound has been relaxed.</span></div><br><div>Mitigation:</div><div>Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep&nbsp;<span>log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.</span></div><br><div>Resolution:</div><div>From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with&nbsp;<span>overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is&nbsp;</span><span>re-queued only when its time moves forward.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835 Loop with unreachable exit condition ('infinite loop')"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:45:08.114Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111496", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:19:35.662Z", "dateReserved": "2026-10-16T09:55:02.432Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-28T16:45:08.114Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:kafka-streams", "packageURL": "pkg:maven/org.apache.kafka/kafka-streams", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.1.2", "status": "affected", "version": "1.1.0", "versionType": "semver"}, {"lessThanOrEqual": "4.2.1", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThanOrEqual": "4.3.1", "status": "affected", "version": "4.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()\u00a0computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no\u00a0overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that\u00a0value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then\u00a0re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record\u00a0stays in the topic the hang returns on restart; an application whose partitions are all affected\u00a0becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster.\u00a0Triggering it needs write access to a source topic whose topology uses stream-time punctuation,\u00a0and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by\u00a0default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers\u00a0or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep\u00a0log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with\u00a0overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is\u00a0re-queued only when its time moves forward."}], "id": "CVE-2026-111496", "lastModified": "2026-11-05T20:17:41.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111496", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:19:30.610539Z", "version": "2.0.3"}}]}, "published": "2026-10-28T17:17:39.693", "references": [{"source": "security@apache.org", "url": "https://kafka.apache.org/cve-list"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/14"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-835"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.kafka/kafka-streams: Kafka Streams: Denial of Service via integer overflow in timestamp calculation", "id": "2563014", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563014"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()\u00a0computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no\u00a0overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that\u00a0value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then\u00a0re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\nImpact:\nA single record is enough. The affected StreamThread stops processing, and because the record\u00a0stays in the topic the hang returns on restart; an application whose partitions are all affected\u00a0becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster.\u00a0Triggering it needs write access to a source topic whose topology uses stream-time punctuation,\u00a0and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by\u00a0default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers\u00a0or where that bound has been relaxed.\nMitigation:\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep\u00a0log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\nResolution:\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with\u00a0overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is\u00a0re-queued only when its time moves forward.", "A flaw was found in Kafka Streams. An attacker with write access to a source topic can cause a Denial of Service (DoS) by submitting a record with an excessively large timestamp. Due to a missing integer overflow check when scheduling periodic stream tasks, the calculation overflows and causes the processing thread to enter an infinite loop, stalling stream execution and rendering the application unresponsive."], "mitigation": {"lang": "en:us", "value": "To reduce exposure to this issue without modifying application binaries:\n1. Restrict write access to source topics:\nEnforce Kafka Access Control Lists (ACLs) to restrict write permissions on topics consumed by Kafka Streams topologies that rely on stream-time punctuation, ensuring only authorized producers can publish records.\n2. Enforce timestamp boundaries on brokers and topics:\nConfigure timestamp limits on Kafka source topics to reject messages with extreme future timestamps. Apply the topic configuration dynamically using administrative scripts:\nkafka-configs.sh --bootstrap-server <broker-host>:<port> --entity-type topics --entity-name <topic-name> --alter --add-config log.message.timestamp.after.max.ms=3600000\nAlternatively, enforce `log.message.timestamp.after.max.ms` cluster-wide in the broker configuration file.\nCaveats:\nRestricting message timestamp boundaries causes brokers to reject records outside the configured time delta, which could disrupt producers with unsynchronized system clocks. If applying changes cluster-wide at the broker configuration level, a service restart or configuration reload of Kafka brokers is required, which may temporarily disrupt active client connections."}, "name": "CVE-2026-111496", "package_state": [{"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Fix deferred", "package_name": "kafka-streams", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "kafka-streams", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "kafka-streams", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-10-28T16:45:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111496\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111496\nhttps://kafka.apache.org/cve-list"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires authenticated write permissions to a source topic feeding a stream-time punctuation topology, and affects only client-side stream processing threads rather than the core Kafka broker infrastructure. Furthermore, brokers configured with default timestamp boundary checks reject extreme future timestamps, limiting practical exploitability to environments where timestamp validation is disabled or relaxed. If triggered, the flaw results in stream processing thread deadlocks, halting partition consumption until the malformed message is handled.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,4.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Kafka", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kafka", "vendor": "apache"}], "created": "2026-10-28T18:30:15.306525+00:00", "updated": "2026-11-05T21:30:17.959211+00:00", "vendors": ["apache", "apache$PRODUCT$kafka"]}