Description
Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before offset commit, causing a persistent crash loop.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Trendyol | kafka-konsumer | 2.3.3 – < 2.6.18 | 2.6.18 |
References
- GitHub Security Advisory (GHSA-jjgw-p88q-qrxr) vendor-advisory
- https://github.com/Trendyol/kafka-konsumer/commit/a290c08b81c70c2d5d4e1f40e4997eae34306078 patch
- kafka-konsumer v2.6.18 Release Notes release-notes
- https://github.com/Trendyol/kafka-konsumer/blob/v2.6.17/batch_consumer.go#L204-L264 technical-description
- VulnCheck Advisory: Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer Panic third-party-advisory