As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
Apache Kafka versions 2.4.0 through 4.3.1 contain a vulnerability in flexible protocol request parsing that allows an attacker to trigger an out-of-memory condition on brokers. The code-generated readers for flexible protocol versions retain raw tagged field objects based on a count declared by the sender, with bounds checked only against the outer request frame size rather than a per-field limit.
Why it matters: Kafka operators running affected versions (2.4.0 to 4.1.2, 4.2.0 to 4.2.1, or 4.3.0 to 4.3.1) face denial of service risk from unauthenticated remote attackers who can craft malicious requests to exhaust broker memory; immediate patching is required.
- Source published
- First seen by Cybersecurity Tracker