Denial of Service Vulnerability in Trendyol kafka-konsumer Software

CVE-2026-124465

What is CVE-2026-124465?

The Trendyol kafka-konsumer software versions prior to 2.6.18 contain a flaw in batch_consumer.go that leads to denial of service. This occurs when the consumer attempts to process a message that exceeds the defined MessageGroupByteSizeLimit, resulting in a panic. Attackers with the capability to produce messages to a topic can exploit this by sending oversized records, thereby triggering a persistent crash loop in the consumer before it can commit offsets. This vulnerability has significant implications for system stability and data processing continuity.

References