Stream-Time Punctuation Vulnerability in Apache Kafka Products

CVE-2026-111496

What is CVE-2026-111496?

A vulnerability in Kafka Streams enables a process hang when a record timestamp approaches Long.MAX_VALUE. The next punctuation time computation lacks overflow checks, leading to indefinite looping within the StreamThread, causing the application to stall. This impacts stream processing but not brokers or clusters, making the Streams application unresponsive on older brokers or those with relaxed timestamp constraints. Mitigation requires upgrading to versions 4.2.2, 4.3.2, or 4.4.0, where overflow-checked arithmetic is implemented.

References