---
id: "CVE-2026-124465"
page: "https://infrastack.ai/live/CVE-2026-124465"
kind: "vulnerability"
aliases: ["CVE-2026-124465"]
title: "kafka-konsumer: oversized Kafka record crashes Go batch consumer in a loop"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "kafka", "kafka-konsumer", "package"]
not_affected_if: ["not-batch-consumer", "trusted-producers-only", "version-2.6.18-or-later"]
published_at: "2026-11-08T14:18:14+00:00"
first_seen_at: "2026-11-08T14:48:40+00:00"
updated_at: "2026-11-08T14:49:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124465", "first_seen_at": "2026-11-08T14:48:40+00:00"}]
exploit_sources: []
---

# kafka-konsumer: oversized Kafka record crashes Go batch consumer in a loop

Link for people: https://infrastack.ai/live/CVE-2026-124465 (this .md is for agents)

Trendyol's kafka-konsumer Go library panics in its batch consumer when one record is larger than MessageGroupByteSizeLimit. An attacker who can write to the consumed topic can send one oversized record that keeps the consumer crashing before it commits its offset.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the kafka-konsumer version in go.mod: `github.com/Trendyol/kafka-konsumer` below `2.6.18` is affected.
- Look for use of the batch consumer (`batch_consumer.go`) with `MessageGroupByteSizeLimit` set.
- Check whether untrusted producers can write to the topic the service consumes.

## Fix

- kafka-konsumer: move to `2.6.18` or later (from `2.3.3` up to, not including, `2.6.18`).

## Timeline

- 2026-11-08T14:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124465

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/trendyol-kafka-konsumer-2.3.3-before-2.6.18-denial-of-service-via-batch-consumer-panic
- [fix] Patch: github.com https://github.com/Trendyol/kafka-konsumer/commit/a290c08b81c70c2d5d4e1f40e4997eae34306078
- [fix] Release notes: github.com https://github.com/Trendyol/kafka-konsumer/releases/tag/v2.6.18

## From the sources

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_