Threats affecting pkg:golang/kafka-konsumer

CVE-2026-124465 is a denial of service vulnerability in Trendyol kafka-konsumer versions 2.3.3 up to but not including 2.6.18. The flaw occurs in batch_consumer.go where the consumer panics if a single record exceeds the MessageGroupByteSizeLimit. An attacker able to produce messages to the consumed Kafka topic can send an oversized record that causes the consumer to crash before committing offsets, resulting in a persistent crash loop.