{"id":"CVE-2026-111496","title":"Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation","summary":"Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or nea…","severity":"none","cwe":["CWE-190","CWE-835"],"vendor":"Apache Software Foundation","product":"org.apache.kafka:kafka-streams","affected":["org.apache.kafka:kafka-streams >= 1.1.0 <= 4.1.2","org.apache.kafka:kafka-streams >= 4.2.0 <= 4.2.1","org.apache.kafka:kafka-streams >= 4.3.0 <= 4.3.1"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T20:06:55.726Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111496","references":[{"url":"https://kafka.apache.org/cve-list"}],"tags":["cve.org"],"epss":0.00204,"epssPercentile":0.10377,"ingestedAt":"2026-10-28T17:14:44.464Z","slug":"CVE-2026-111496","body":"## Overview\n\nKafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.\n\n## Affected\n\n- `org.apache.kafka:kafka-streams >= 1.1.0 <= 4.1.2`\n- `org.apache.kafka:kafka-streams >= 4.2.0 <= 4.2.1`\n- `org.apache.kafka:kafka-streams >= 4.3.0 <= 4.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}