---
id: CVE-2026-111496
title: >-
  Apache Kafka: Kafka Streams StreamThread hang from integer overflow in
  stream-time punctuation
summary: "Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next()\_computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no\_overflow check. A record with a timestamp at or nea…"
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-190
  - CWE-835
vendor: Apache Software Foundation
product: 'org.apache.kafka:kafka-streams'
affected:
  - 'org.apache.kafka:kafka-streams >= 1.1.0 <= 4.1.2'
  - 'org.apache.kafka:kafka-streams >= 4.2.0 <= 4.2.1'
  - 'org.apache.kafka:kafka-streams >= 4.3.0 <= 4.3.1'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T19:19:30.610539Z'
published: '2026-10-28'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:19:35.662Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111496'
references:
  - url: 'https://kafka.apache.org/cve-list'
tags:
  - cve.org
epss: 0.00204
epssPercentile: 0.10415
ingestedAt: '2026-10-28T17:14:44.464Z'
---

## Overview

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.


Impact:

A single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed.


Mitigation:

Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.


Resolution:

From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.

## Affected

- `org.apache.kafka:kafka-streams >= 1.1.0 <= 4.1.2`
- `org.apache.kafka:kafka-streams >= 4.2.0 <= 4.2.1`
- `org.apache.kafka:kafka-streams >= 4.3.0 <= 4.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.