CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
// AI summary
Apache Kafka versions 0.10.0.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1 have CVE-2026-111551, a denial of service flaw via unbounded memory allocation in Kafka Streams and client deserializers.
// from the source
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 0.10.0.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a...