{"id":"CVE-2026-124465","kind":"vulnerability","aliases":["CVE-2026-124465"],"related":[],"title":"kafka-konsumer: oversized Kafka record crashes Go batch consumer in a loop","description":"Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.","summary":"Trendyol's kafka-konsumer Go library panics in its batch consumer when one record is larger than MessageGroupByteSizeLimit. An attacker who can write to the consumed topic can send one oversized record that keeps the consumer crashing before it commits its offset.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","kafka","kafka-konsumer","package"],"not_affected_if":["not-batch-consumer","trusted-producers-only","version-2.6.18-or-later"],"how_to_check":"- Check the kafka-konsumer version in go.mod: `github.com/Trendyol/kafka-konsumer` below `2.6.18` is affected.\n- Look for use of the batch consumer (`batch_consumer.go`) with `MessageGroupByteSizeLimit` set.\n- Check whether untrusted producers can write to the topic the service consumes.","fix":"- kafka-konsumer: move to `2.6.18` or later (from `2.3.3` up to, not including, `2.6.18`).","status":"open","published_at":"2026-11-08T14:18:14+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","triaged_at":"2026-11-08T14:49:40+00:00","updated_at":"2026-11-08T14:49:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-08T14:49:40Z","model":"claude-haiku-5-5","output":{"fix":"- kafka-konsumer: move to `2.6.18` or later (from `2.3.3` up to, not including, `2.6.18`).","reach":"network","title":"kafka-konsumer: oversized Kafka record crashes Go batch consumer in a loop","impact":"medium","summary":"Trendyol's kafka-konsumer Go library panics in its batch consumer when one record is larger than MessageGroupByteSizeLimit. An attacker who can write to the consumed topic can send one oversized record that keeps the consumer crashing before it commits its offset.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","kafka","kafka-konsumer"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"consumer crash loop halts message processing until the bad record is removed","analyst_note":"","how_to_check":"- Check the kafka-konsumer version in go.mod: `github.com/Trendyol/kafka-konsumer` below `2.6.18` is affected.\n- Look for use of the batch consumer (`batch_consumer.go`) with `MessageGroupByteSizeLimit` set.\n- Check whether untrusted producers can write to the topic the service consumes.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-batch-consumer","trusted-producers-only","version-2.6.18-or-later"],"who_is_affected":"Go services that import Trendyol's kafka-konsumer, versions from 2.3.3 before 2.6.18, and use its batch consumer. Exposure depends on whether producers outside the trusted set can publish to the consumed topic. Services that do not use the batch consumer or do not consume from such topics can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000789,"input_tokens":4656,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124465':16A,19A '-2026':15A,18A '2.3.3':74C '2.6.18':76C 'abl':94C 'attack':46B,93C 'batch':9A,36B 'batch_consumer.go':84C 'caus':113C 'commit':66B,112C 'consum':10A,37B,52B,62B,99C,109C 'contain':77C 'crash':7A,63B,116C 'cve':14A,17A 'denial':79C 'exceed':91C 'go':8A,20B,31B 'kafka':2A,5A,21B,23B,29B,71C 'kafka-konsum':1A,22B,28B,70C 'keep':60B 'konsum':3A,24B,30B,72C 'larger':42B 'librari':32B 'loop':13A,117C 'messagegroupbytesizelimit':44B,92C 'offset':68B,111C 'one':39B,56B,103C 'overs':4A,57B,104C 'packag':25B 'panic':33B,86C 'persist':115C 'produc':96C 'publish':102C 'record':6A,40B,58B,90C,105C 'send':55B 'servic':81C 'singl':89C 'termin':107C 'topic':53B,100C 'trendyol':26B,69C 'vulner':82C 'write':49B","nicknames":[],"mitigations":[],"who_affected":"Go services that import Trendyol's kafka-konsumer, versions from 2.3.3 before 2.6.18, and use its batch consumer. Exposure depends on whether producers outside the trusted set can publish to the consumed topic. Services that do not use the batch consumer or do not consume from such topics can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["go","high","kafka","kafkakonsumer","package"],"campaign_type":null,"search_a":"'-124465':16A,19A '-2026':15A,18A 'batch':9A 'consum':10A 'crash':7A 'cve':14A,17A 'go':8A 'kafka':2A,5A 'kafka-konsum':1A 'konsum':3A 'loop':13A 'overs':4A 'record':6A","search_b":"'attack':46B 'batch':36B 'commit':66B 'consum':37B,52B,62B 'crash':63B 'go':20B,31B 'kafka':21B,23B,29B 'kafka-konsum':22B,28B 'keep':60B 'konsum':24B,30B 'larger':42B 'librari':32B 'messagegroupbytesizelimit':44B 'offset':68B 'one':39B,56B 'overs':57B 'packag':25B 'panic':33B 'record':40B,58B 'send':55B 'topic':53B 'trendyol':26B 'write':49B","search_c":"'2.3.3':74C '2.6.18':76C 'abl':94C 'attack':93C 'batch_consumer.go':84C 'caus':113C 'commit':112C 'consum':99C,109C 'contain':77C 'crash':116C 'denial':79C 'exceed':91C 'kafka':71C 'kafka-konsum':70C 'konsum':72C 'loop':117C 'messagegroupbytesizelimit':92C 'offset':111C 'one':103C 'overs':104C 'panic':86C 'persist':115C 'produc':96C 'publish':102C 'record':90C,105C 'servic':81C 'singl':89C 'termin':107C 'topic':100C 'trendyol':69C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-21T12:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124465","severity":null,"published_at":"2026-11-08T14:18:14+00:00","modified_at":"2026-11-08T14:18:14+00:00","first_seen_at":"2026-11-08T14:48:40+00:00","fetched_at":"2026-11-08T14:48:40+00:00","note":null}],"documents":[{"id":102113,"url":"https://github.com/Trendyol/kafka-konsumer/commit/a290c08b81c70c2d5d4e1f40e4997eae34306078","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":102114,"url":"https://github.com/Trendyol/kafka-konsumer/releases/tag/v2.6.18","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":102115,"url":"https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T12:18:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102116,"url":"https://www.vulncheck.com/advisories/trendyol-kafka-konsumer-2.3.3-before-2.6.18-denial-of-service-via-batch-consumer-panic","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}