CVE-2026-124465
Received Received - Intake

Denial of Service in Trendyol Kafka-Konsumer

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124465
EUVD
EUVD-2026-119605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trendyol kafka-konsumer From 2.3.3 (inc) to 2.6.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in Trendyol kafka-konsumer versions 2.3.3 to 2.6.17. When a single Kafka record exceeds the configured MessageGroupByteSizeLimit, the batch consumer panics and crashes before committing offsets. Attackers can exploit this by publishing an oversized record, causing the consumer to enter a persistent crash loop.

Detection Guidance

Monitor consumer logs for panic errors related to batch processing or oversized messages. Check if the consumer crashes repeatedly after processing a single large message. Verify if the MessageGroupByteSizeLimit configuration is set and if messages exceeding this limit cause failures.

Impact Analysis

The vulnerability can cause your Kafka consumer service to crash repeatedly, leading to downtime and disrupted message processing. This impacts availability as the consumer cannot process messages until manually restarted or patched. It requires an attacker to have publish permissions to the Kafka topic.

Compliance Impact

This vulnerability primarily impacts availability by causing persistent crashes in the Kafka consumer service when processing oversized messages. While it does not directly expose or alter data, prolonged unavailability could lead to delays in processing sensitive data, potentially violating GDPR's timeliness principle or HIPAA's access requirements. However, the core issue is a denial-of-service condition rather than a data breach.

Mitigation Strategies
  • Upgrade to kafka-konsumer version 2.6.18 or later to address the panic issue with oversized messages.
  • Review and adjust MessageGroupByteSizeLimit settings to ensure they align with expected message sizes.
  • Implement monitoring for consumer crashes and message processing failures to detect exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...