{"id":"UBUNTU-CVE-2026-111496","details":"Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread. Impact: A single record is enough. The affected StreamThread stops processing, and because the record stays in the topic the hang returns on restart; an application whose partitions are all affected becomes unresponsive. Only the Streams application is affected, not the brokers or the cluster. Triggering it needs write access to a source topic whose topology uses stream-time punctuation, and a broker that stores the record: brokers from Apache Kafka 4.0.0 reject such a timestamp by default (log.message.timestamp.after.max.ms, one hour), so it is reachable only on older brokers or where that bound has been relaxed. Mitigation: Upgrade Kafka Streams to 4.2.2, 4.3.2, or 4.4.0. As defense in depth, keep log.message.timestamp.after.max.ms bounded on source topics and restrict write access to them. Resolution: From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the next punctuation time is computed with overflow-checked arithmetic (clamped to Long.MAX_VALUE), and a rescheduled punctuation is re-queued only when its time moves forward.","modified":"2026-10-29T20:04:25.720760526Z","published":"2026-10-29T00:00:00Z","upstream":["CVE-2026-111496"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-111496"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-111496"},{"type":"REPORT","url":"https://kafka.apache.org/cve-list"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2026/10/28/14"}],"affected":[{"package":{"name":"kafka","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/kafka?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0u2-0ubuntu3.1","2.2.0u2-0ubuntu3.2","2.2.2u1-0ubuntu1+esm2"],"ecosystem_specific":{"binaries":[{"binary_name":"kafka","binary_version":"2.2.2u1-0ubuntu1+esm2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111496.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}