CVE-2026-124465: falha de alta gravidade em Trendyol kafka-konsumer
Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1
Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Trendyol · kafka-konsumerReferências
https://github.com/Trendyol/kafka-konsumer/blob/v2.6.17/batch_consumer.go#L204-L264https://github.com/Trendyol/kafka-konsumer/commit/a290c08b81c70c2d5d4e1f40e4997eae34306078https://github.com/Trendyol/kafka-konsumer/releases/tag/v2.6.18https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxrhttps://www.vulncheck.com/advisories/trendyol-kafka-konsumer-2.3.3-before-2.6.18-denial-of-service-via-batch-consumer-panic