CVE-2026-111496: Kafka Streams derives its stream-time clock from record timestamps

Routine

HIGH n/aWATCHLIST

CVE-2026-111496 is a high-severity flaw (CVSS n/a) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, s

Why this priority

On your watchlist

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	n/a (High)
EPSS exploit chance	n/a
CISA exploited list	No
Weakness	CWE-190, CWE-835
Published	2026-10-28
Last modified	2026-10-28

Publisher (CNA): Apache Software Foundation

Last updated 2026-10-28 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-10-28 17:17 UTCPublished CVE record published
2026-10-28 17:17 UTCUpdated Record last modified

Advisories and coverage

Research and news

oss-security list: CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation 2026-10-28

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-111496?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-111496 being exploited?

CVE-2026-111496 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-111496 affect?

CVE-2026-111496 affects affected software. Severity is high (CVSS n/a). Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near L

How urgent is CVE-2026-111496?

Priority 5/100. On your watchlist

Software pages

Apache Kafka vulnerabilities

References

← Back to latest CVEs