CVE-2026-124465: Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic
Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batchconsumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to produce messages to a Kafka topic consumed by the affected kafka-konsumer instance. They can trigger the condition by publishing a single record larger than MessageGroupByteSizeLimit.
What is the operational impact of a successful exploit?
The oversized record causes the batch consumer to panic before committing its offset. Because the record remains uncommitted, the consumer can repeatedly encounter it on restart and enter a persistent crash loop.
Which versions need remediation?
kafka-konsumer versions from 2.3.3 up to, but not including, 2.6.18 are affected. Upgrade to version 2.6.18 or later.