Threats affecting pkg:maven/Apache Software Foundation/org.apache.kafka:kafka-streams

CVE-2026-111551 is a vulnerability in Apache Kafka where several deserialization paths allocate memory based on unvalidated size or count fields from input data. This can lead to excessive memory allocation, causing OutOfMemoryError and crashing the affected consumer or Kafka Streams thread. The issue affects Kafka versions up to 4.1.2, 4.2.1, and 4.3.1. The vulnerability is mitigated by upgrading to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, which include validation of declared sizes before allocation.

CVE-2026-111496 is an integer overflow vulnerability in Apache Kafka Streams affecting versions from 1.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The flaw occurs when computing the next punctuation time without overflow checks, causing the stream-time clock to overflow to a negative value and stall the processing thread indefinitely. This leads to the affected StreamThread hanging and the Streams application becoming unresponsive. The issue requires write access to a source topic using stream-time punctuation and is mitigated in Kafka Streams versions 4.2.2, 4.3.2, and 4.4.0 by adding overflow-checked arithmetic and clamping the punctuation time. Brokers from Kafka 4.0.0 onward reject such problematic timestamps by default, limiting exposure to older or misconfigured brokers.