{"id":"CVE-2026-111496","kind":"vulnerability","aliases":["CVE-2026-111496"],"related":[],"title":"Kafka Streams: a far-future record timestamp hangs stream threads indefinitely","description":"Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread.\n\n\nImpact:\n\nA single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed.\n\n\nMitigation:\n\nUpgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.","summary":"Kafka Streams computes the next stream-time punctuation without an overflow check, so a record with a timestamp near Long.MAX_VALUE makes the punctuation time overflow negative. The queue then loops on that time while holding a lock, stalling the affected StreamThread, and the hang returns on restart because the record stays in the topic.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-pipelines","java","kafka","kafka-streams","package"],"not_affected_if":["default-broker-timestamp-bound","no-stream-time-punctuation"],"how_to_check":"- Run `kafka-streams-application-reset` or check the Kafka Streams client version in your build file; affected versions are before `4.2.2`, `4.3.2`, and `4.4.0` on their respective lines.\n- Check whether the Streams topology uses stream-time punctuation (`context.schedule` with `PunctuationType.STREAM_TIME`).\n- Check whether brokers accept far-future timestamps: look for `log.message.timestamp.after.max.ms` on source-topic brokers; brokers from Apache Kafka 4.0.0 reject them by default.","fix":"- Upgrade Kafka Streams to `4.2.2`, `4.3.2`, or `4.4.0`.\n- Keep `log.message.timestamp.after.max.ms` bounded on source topics (default one hour on 4.0.0+ brokers).\n- Restrict write access to source topics.","status":"open","published_at":"2026-10-28T17:17:39+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:35:10+00:00","updated_at":"2026-10-28T17:35:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:35:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kafka Streams to `4.2.2`, `4.3.2`, or `4.4.0`.\n- Keep `log.message.timestamp.after.max.ms` bounded on source topics (default one hour on 4.0.0+ brokers).\n- Restrict write access to source topics.","reach":"network","title":"Kafka Streams: a far-future record timestamp hangs stream threads indefinitely","impact":"medium","summary":"Kafka Streams computes the next stream-time punctuation without an overflow check, so a record with a timestamp near Long.MAX_VALUE makes the punctuation time overflow negative. The queue then loops on that time while holding a lock, stalling the affected StreamThread, and the hang returns on restart because the record stays in the topic.","category":"package","nicknames":[],"who_cares":["kafka","kafka-streams","java","data-pipelines"],"confidence":0.6,"needs_auth":"yes","worst_case":"A stream thread stalls and stops processing until the record is removed","analyst_note":"Confirm the affected version ranges for each Kafka Streams release line from the Apache advisory; the NVD entry gave no severity or version list beyond the fixed releases.","how_to_check":"- Run `kafka-streams-application-reset` or check the Kafka Streams client version in your build file; affected versions are before `4.2.2`, `4.3.2`, and `4.4.0` on their respective lines.\n- Check whether the Streams topology uses stream-time punctuation (`context.schedule` with `PunctuationType.STREAM_TIME`).\n- Check whether brokers accept far-future timestamps: look for `log.message.timestamp.after.max.ms` on source-topic brokers; brokers from Apache Kafka 4.0.0 reject them by default.","needs_analyst":true,"not_affected_if":["no-stream-time-punctuation","default-broker-timestamp-bound"],"who_is_affected":"Only Kafka Streams applications are affected, not the brokers or the cluster. Exposure requires a topology that uses stream-time punctuation and a source topic that a writer can reach and where the broker stores far-future timestamps, which is the case on older brokers or where the one-hour bound has been relaxed. Applications without stream-time punctuation, or on brokers that reject such timestamps, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000793,"input_tokens":3742,"output_tokens":838,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111496':15A,18A '-2026':14A,17A '1':104C '4.0.0':229C '4.2.2':259C,283C '4.3.2':260C,284C '4.4.0':262C,286C 'access':206C,276C 'advanc':120C 'affect':69B,164C,187C,195C 'apach':227C,281C 'applic':182C,193C 'arithmet':297C 'becom':188C 'bound':250C,269C 'broker':198C,220C,225C,246C 'check':40B,109C,296C 'clamp':298C 'clock':91C 'cluster':201C 'comput':30B,96C,292C 'cve':13A,16A 'data':20B 'data-pipelin':19B 'default':235C 'defens':264C 'depth':266C 'deriv':86C 'enough':162C 'far':5A 'far-futur':4A 'forward':315C 'futur':6A 'hang':9A,73B,177C 'hold':64B,151C 'hour':238C 'impact':157C 'indefinit':12A,149C 'interv':105C 'intervalsmiss':103C 'java':22B 'kafka':1A,23B,25B,28B,84C,228C,256C,282C 'kafka-stream':24B 'keep':267C 'lock':66B,153C 'log.message.timestamp.after.max.ms':236C,268C 'long.max':48B,118C,300C 'loop':59B,146C 'make':50B 'mitig':254C 'move':314C 'near':47B,117C 'need':204C 'negat':55B,136C 'next':32B,98C,128C,288C 'older':245C 'one':237C 'overflow':39B,54B,108C,133C,295C 'overflow-check':294C 'packag':27B 'partit':184C 'pipelin':21B 'process':167C 'punctuat':36B,52B,99C,132C,217C,289C,305C 'punctuationqueu':138C 'punctuationschedule.next':95C 'queu':309C 'queue':57B,142C 're':141C,308C 're-queu':140C,307C 'reachabl':242C 'record':7A,43B,79B,93C,111C,160C,171C,224C 'reject':230C 'relax':253C 'reschedul':304C 'resolut':279C 'restart':76B,180C 'restrict':274C 'return':74B,178C 'singl':159C 'sourc':209C,271C 'stall':67B,154C 'stay':80B,172C 'stop':166C 'store':222C 'stream':2A,10A,26B,29B,34B,85C,89C,121C,130C,192C,215C,257C 'stream-tim':33B,88C,129C,214C 'streamthread':70B,156C,165C 'thread':11A 'time':35B,53B,62B,90C,100C,122C,131C,137C,144C,216C,290C,313C 'timestamp':8A,46B,94C,102C,114C,233C 'topic':83B,175C,210C,272C 'topolog':212C 'trigger':202C 'unrespons':189C 'upgrad':255C 'use':213C 'valu':49B,119C,125C,301C 'whose':183C,211C 'without':37B 'write':205C,275C","nicknames":[],"mitigations":[],"who_affected":"Only Kafka Streams applications are affected, not the brokers or the cluster. Exposure requires a topology that uses stream-time punctuation and a source topic that a writer can reach and where the broker stores far-future timestamps, which is the case on older brokers or where the one-hour bound has been relaxed. Applications without stream-time punctuation, or on brokers that reject such timestamps, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111496","severity":null,"published_at":"2026-10-28T17:17:39+00:00","modified_at":"2026-10-28T17:17:39+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}