The attacker needs write access to a source topic used by a Kafka Streams topology that uses stream-time punctuation. The broker must also accept and store a record with a timestamp at or near Long.MAX_VALUE.
Brokers from Apache Kafka 4.0.0 reject this timestamp by default through log.message.timestamp.after.max.ms, which defaults to one hour. The issue is therefore reachable only where the broker stores the malicious timestamped record.
No. The triggering record remains in the topic, so the StreamThread hang returns when the application restarts and processes that record again.
An affected StreamThread stops processing because it loops indefinitely while holding a lock. If all application partitions are affected, the Streams application becomes unresponsive; brokers and the Kafka cluster are not affected.