early signals oss-security infra

CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

// AI summary

Apache Kafka versions 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 have CVE-2026-111073 allowing a broker out-of-memory denial of service via PushTelemetry metrics payloads.

// from the source

Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 3.7.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 Description: The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client s metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the decompressed output size, growing a...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org