CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
// AI summary
Apache Kafka versions 0.11.0.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1 have CVE-2026-114349 allowing denial of service via unbounded memory allocation during compressed record batch decoding.
// from the source
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 0.11.0.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch...