Threats tagged 'ghsa-5hcw-679g-g6cq'

A denial of service vulnerability exists in Trendyol kafka-konsumer versions from 2.3.3 up to but not including 2.6.18. The flaw occurs in batch_consumer.go where the consumer panics if a single record exceeds the MessageGroupByteSizeLimit. An attacker who can produce messages to the consumed topic can send an oversized record that causes the consumer to crash repeatedly before committing offsets, resulting in a persistent crash loop.