{"schema":"threatline.record/2","record":{"id":"CVE-2026-111496","aliases":[],"summary":"Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation","details":"Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.","categories":["Unclassified"],"product":"Apache Kafka","vendor":"Apache Software Foundation","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111496","source_modified_at":"2026-10-28T20:06:55.726Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"Apache Kafka","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"1.1.0","lessThanOrEqual":"4.1.2","versionType":"semver"},{"status":"affected","version":"4.2.0","lessThanOrEqual":"4.2.1","versionType":"semver"},{"status":"affected","version":"4.3.0","lessThanOrEqual":"4.3.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T16:45:08.114Z","modified_at":"2026-10-28T20:06:55.726Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111496","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:06:55.726Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://kafka.apache.org/cve-list","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T20:06:55.726Z","content_hash":"e4b81ef498dc841190605ae0de596e667d3cd12a070f4ee440786438527c3d68"}}