Kafka Streams can hang on punctuation integer overflow (CVE-2026-111496)
Original title: CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
A record timestamp near Long.MAX_VALUE can overflow the next punctuation time and stall a StreamThread.
Apache rates CVE-2026-111496 low. Kafka Streams computes the next punctuation time from a record timestamp plus missed intervals without an overflow check. A timestamp at or near Long.MAX_VALUE advances stream time so the addition can wrap. The post lists Apache Kafka 1.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The snippet does not name a fix.
Unconfirmed: The snippet does not state a fixed version or whether the hang is exploited.
- Posted by Manikumar on October 28 with severity low.
- PunctuationSchedule.next() adds timestamp plus missed intervals times the interval.
- No overflow check is described in that calculation.
- The feed text cuts off before any fix or workaround.
Impact: Kafka Streams StreamThread hang
| Product | Affected |
|---|---|
| Apache Kafka | 1.1.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1 |
- CVEs
- CVE-2026-111496
- Vendors
- Apache
- Products
- Apache KafkaKafka Streams
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111496 | Integer overflow hang in Kafka Streams stream-time punctuation | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 1. 1. 0 through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.