GHSA-jjgw-p88q-qrxr: Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic

Q: Which deployments are exposed?

Deployments using Trendyol kafka-konsumer versions from 2.3.3 through versions before 2.6.18 are affected if they consume a topic to which an attacker can produce records.

Q: What does an attacker need to trigger the denial of service?

The attacker needs the ability to publish to a topic consumed by the vulnerable consumer. They can trigger the issue by sending a single record larger than MessageGroupByteSizeLimit.

Q: Why can the failure persist after the consumer restarts?

The panic occurs before the record offset is committed. On restart, the consumer encounters the same oversized record again, which can create a persistent crash loop.

Q: What version should be used to remediate the issue?

Upgrade to kafka-konsumer version 2.6.18 or later.

Published Nov 8, 2026

Updated

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batchconsumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

Affected Software

1 affected component

Trendyol kafka-konsumer>=2.3.3<2.6.18

Event History

Nov 8, 2026

CVE Published

via OSV·01:52 PM

Data Sourced

via OSV·01:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Trendyol kafka-konsumer versions from 2.3.3 through versions before 2.6.18 are affected if they consume a topic to which an attacker can produce records.

What does an attacker need to trigger the denial of service?

The attacker needs the ability to publish to a topic consumed by the vulnerable consumer. They can trigger the issue by sending a single record larger than MessageGroupByteSizeLimit.

Why can the failure persist after the consumer restarts?

The panic occurs before the record offset is committed. On restart, the consumer encounters the same oversized record again, which can create a persistent crash loop.

What version should be used to remediate the issue?

Upgrade to kafka-konsumer version 2.6.18 or later.

GHSA-jjgw-p88q-qrxr: Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the denial of service?

Why can the failure persist after the consumer restarts?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the denial of service?

Why can the failure persist after the consumer restarts?

What version should be used to remediate the issue?