CVE-2026-124465
Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.
| CWE | CWE-617 |
| Vendor | trendyol |
| Product | kafka-konsumer |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for trendyol kafka-konsumer
Be the first to know when new medium vulnerabilities affecting trendyol kafka-konsumer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Trendyol / kafka-konsumer
2.3.3 < 2.6.18
References
github.com: https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr github.com: https://github.com/Trendyol/kafka-konsumer/commit/a290c08b81c70c2d5d4e1f40e4997eae34306078 github.com: https://github.com/Trendyol/kafka-konsumer/releases/tag/v2.6.18 github.com: https://github.com/Trendyol/kafka-konsumer/blob/v2.6.17/batch_consumer.go#L204-L264 vulncheck.com: https://www.vulncheck.com/advisories/trendyol-kafka-konsumer-2.3.3-before-2.6.18-denial-of-service-via-batch-consumer-panic
Credits
Efe Kırbaş