As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
CVE-2026-114349 affects Apache Kafka versions 0.11.0.0 through 4.3.1 and stems from unbounded memory allocation during decompression of record batches. When a broker decodes a compressed batch, it allocates a buffer based on an attacker-controlled size declaration without first validating available bytes or configured limits, enabling denial of service (DoS).
Why it matters: Kafka operators running affected versions (0.11.0.0 through 4.1.2, 4.2.0 through 4.2.1, or 4.3.0 through 4.3.1) should patch immediately to prevent unauthenticated attackers from exhausting broker memory and disrupting message streaming.
- Source published
- First seen by Cybersecurity Tracker