CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

As cited

Copy frozen at 2026-10-28 21:26 UTC (site build).

vulnerabilities

CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

CVE-2026-111073 affects Apache Kafka versions 3.7.0 through 4.3.0 and involves the PushTelemetry application programming interface (API) implementation, which validates only the compressed size of metrics payloads before decompressing them. The broker decompresses payloads without enforcing a size limit on the output, enabling an attacker to craft a small compressed payload that expands to consume excessive memory and trigger an out-of-memory denial of service condition.

Why it matters: Operators of affected Kafka brokers face availability risk from unauthenticated clients sending malicious telemetry payloads; assess your Kafka version against the affected ranges and prioritize patching or telemetry.max.bytes tuning as immediate mitigations.

Source published

2026-10-28 17:31 UTC

First seen by Cybersecurity Tracker

2026-10-28 20:02 UTC