CVE-2026-124465 · Package
NO FIX YET · SEE WHAT TO DO
Trendyol's kafka-konsumer Go library panics in its batch consumer when one record is larger than MessageGroupByteSizeLimit. An attacker who can write to the consumed topic can send one oversized record that keeps the consumer crashing before it commits its offset.
first public Oct 21, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Go services that import Trendyol's kafka-konsumer, versions from 2.3.3 before 2.6.18, and use its batch consumer. Exposure depends on whether producers outside the trusted set can publish to the consumed topic. Services that do not use the batch consumer or do not consume from such topics can skip it.
Not affected if not-batch-consumer, trusted-producers-only, version-2.6.18-or-later
Who cares go, kafka, kafka-konsumer
github.com/Trendyol/kafka-konsumer below 2.6.18 is affected.batch_consumer.go) with MessageGroupByteSizeLimit set.2.6.18 or later (from 2.3.3 up to, not including, ).Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.6.18This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.