{"id":"CVE-2026-111496","aliases":[],"cve":{"records":[{"id":"CVE-2026-111496","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-16T09:55:02.432Z","published":"2026-10-28T16:45:08.114Z","modified":"2026-10-28T20:06:55.726Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-28T16:45:08.114Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-28T20:06:55.726Z"}],"references":[{"url":"https://kafka.apache.org/cve-list","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/14","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-190","description":"CWE-190 Integer overflow or wraparound","source":"apache"},{"id":"CWE-835","description":"CWE-835 Loop with unreachable exit condition ('infinite loop')","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation","titleSource":"apache","descriptionSource":"apache","description":"Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.","score":null,"severity":"unknown","published":"2026-10-28T16:45:08.114Z","modified":"2026-10-28T20:06:55.726Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Kafka","platforms":[],"versions":[{"version":"1.1.0","status":"affected","lessThanOrEqual":"4.1.2","versionType":"semver"},{"version":"4.2.0","status":"affected","lessThanOrEqual":"4.2.1","versionType":"semver"},{"version":"4.3.0","status":"affected","lessThanOrEqual":"4.3.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.kafka/kafka-streams","packageIdentity":{"ecosystem":"Maven","name":"org.apache.kafka:kafka-streams"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111496"}],"remediation":[],"references":["https://kafka.apache.org/cve-list","http://www.openwall.com/lists/oss-security/2026/10/28/14"],"sources":[{"name":"CVE","id":"CVE-2026-111496","modified":"2026-10-28T20:06:55.726Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111496"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-29T14:29:56.913Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:30:32.033Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Apache Kafka versions 1.1.0 to 4.1.2, 4.2.0 to 4.2.1, and 4.3.0 to 4.3.1 are affected by an integer overflow in stream-time punctuation, causing a StreamThread hang. A single record with a high timestamp can trigger this issue, requiring write access to a source topic. The affected StreamThread stops processing.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:13:35.352Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111496"}]}}