CVE-2026-111496

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next computed the next punctuation time as timestamp + intervalsMissed + 1 interval with no overflow check. A record with a timestamp at or near Long.MAXVALUE advances stream time to that value, so the next...

CVE-2026-111496 Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next computed the next punctuation time as timestamp + intervalsMissed + 1 interval with no overflow check. A record with a timestamp at or near Long.MAXVALUE advances stream time to that value, so the next...

EUVD-2026-112171

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next computed the next punctuation time as timestamp + intervalsMissed + 1 interval with no overflow check. A record with a timestamp at or near Long.MAXVALUE advances stream time to that value, so the next...

CVE-2026-111496

Apache Kafka Streams is vulnerable to a StreamThread hang due to an integer overflow in the PunctuationSchedule.next() method. The application derives its stream-time clock from record timestamps; if a record with a timestamp near Long.MAX_VALUE is processed without overflow checks, the next punc...

PT-2026-128294

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next computed the next punctuation time as timestamp + intervalsMissed + 1 interval with no overflow check. A record with a timestamp at or near Long.MAX VALUE advances stream time to that value, so the next...