The vulnerability resides in the batch_consumer.go component of Trendyol kafka‑konsumer. When a single record exceeds the configured MessageGroupByteSizeLimit, the consumer panics, aborts processing and fails to commit the offset. This panic causes the running consumer process to terminate, and it remains in a crash loop if the oversized record continues to be delivered.

The flaw affects versions of Trendyol kafka‑konsumer from 2.3.3 up to but excluding 2.6.18. All releases newer than 2.6.18 contain the fix. The affected product is the kafka‑konsumer library used to consume messages from a Kafka topic.

The CVSS score of 7.1 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have the ability to publish to the Kafka topic consumed by the vulnerable component. An adversary with that capability can generate a single oversized record that triggers the consumer panic, leading to a persistent denial of service until the consumer process is restarted.