External risk intelligence

Kafka Streams Punctuation Overflow Causes Thread Stall

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-111496

The vulnerability resides in Kafka Streams, a library for building internal data processing applications. It requires the ability to write specific, malformed data to a Kafka source topic. Because such topics are typically internal infrastructure components not directly exposed to the public internet, and successful triggering requires specific, non-default broker configurations, public internet reachability is uncommon.

Integer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Kafka Streams that can cause applications to become unresponsive. The issue arises from a timestamp calculation error that, under specific conditions, leads to an infinite loop, halting processing. While the Streams application is affected, not the entire Kafka cluster, a single malformed record can trigger this stall, and the problem can persist even after restarts. Access to a source topic with write privileges and specific broker configurations are needed to exploit this.

A calculation error can freeze Kafka Streams applications.
Unresponsive applications may require manual intervention.
Confirm relevance to internal data processing.

Attack Path

How an attacker could exploit the issue

An attacker could target a Kafka Streams application by sending a specially crafted record to a source topic. This record's timestamp, when processed by the vulnerable `PunctuationSchedule.next()` function, causes an integer overflow. The overflowed negative time then causes the processing thread to repeatedly re-queue the same time, indefinitely stalling the thread and making the application unresponsive.

Requires write access to a source topic.
Triggered by record timestamp near Long.MAX_VALUE.
Application becomes unresponsive.

Live Threat

Current exploitation, exposure, and threat context

A record with a timestamp near the maximum value for a 64-bit integer could cause a Kafka Streams application to enter an infinite loop, causing it to stop processing data and become unresponsive. This issue can persist even after restarting the application if the problematic record remains in the source topic. The Streams application, not the Kafka brokers or cluster, is the sole affected component.

Unresponsive Streams applications.
Record triggers infinite processing loop.
Application stops functioning entirely.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Kafka Streams applications, specifically the StreamThread responsible for processing records and punctuation. Application owners and platform teams are likely responsible for managing Kafka Streams deployments. The first practical step is to identify all Kafka Streams applications, confirm which ones use stream-time punctuation, and assess if they are impacted by records with timestamps near `Long.MAX_VALUE` and if their source topics are reachable with potentially disallowed timestamps.

Identify affected Kafka Streams applications.
Verify topic write access and timestamps.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kafka Streams and how does it handle data?

Kafka Streams is a client library used to build Java applications that process and analyze data stored in Apache Kafka. It allows developers to create complex stream-processing logic, such as transformations or aggregations, by reading from and writing to Kafka topics. This library is designed for building internal microservices and data pipelines that need to respond to information as it arrives in real-time.

What is the underlying weakness in CVE-2026-111496?

This vulnerability involves an integer overflow (CWE-190) and an infinite loop (CWE-835). It occurs because the library fails to check for arithmetic overflow when calculating the next scheduled time for tasks. When a record contains an extremely high timestamp, the calculation wraps around to a negative value. The system then enters a loop trying to process this invalid negative time, causing the processing thread to become stuck indefinitely.

How can an attacker trigger this thread stall?

An attacker needs write access to a source topic that the Kafka Streams application consumes. The trigger is a record with a timestamp near the maximum possible 64-bit integer value. This bug does not occur if the underlying Kafka broker correctly validates timestamps, specifically using default settings that reject records too far in the future. If those broker-level restrictions are disabled or if using older, unpatched broker software, the application is at risk.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is unlikely to be reachable from the public internet. Because the issue requires write access to internal Kafka topics and relies on specific non-default broker configurations to accept the malformed timestamp, it is primarily an internal infrastructure concern rather than a publicly exposed service threat. Most Kafka Streams deployments operate within protected, non-public segments of a network.

How should I respond to this threat?

First, identify which of your Kafka Streams applications utilize stream-time punctuation, as these are the only ones affected. Your primary goal is to upgrade the Kafka Streams library to version 4.2.2, 4.3.2, or 4.4.0, which includes the necessary overflow checks. As a secondary defense, verify that your Kafka brokers are configured to reject future-dated timestamps and ensure that write access to your input topics is strictly limited to authorized sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.