As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
Apache Kafka versions 0.10.0.0 through 4.3.1 contain a denial of service vulnerability in Kafka Streams and client deserializers that stems from unbounded memory allocation. The flaw allows attackers to craft small inputs that declare extremely large size fields, causing the deserialization logic to attempt allocation of massive arrays, collections, or byte buffers without validating available bytes.
Why it matters: Organizations running Kafka 0.10.0.0 through 4.3.1 face potential denial of service attacks; patching or upgrading affected versions is required to prevent service disruption from crafted deserializer inputs.
- Source published
- First seen by Cybersecurity Tracker