Apache Kafka brokers can run out of memory from protocol arrays (CVE-2026-111108)
Original title: CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
Code-generated readers size arrays from a sender-declared count checked only against remaining buffer bytes.
An oss-security post rates CVE-2026-111108 important. Apache Kafka's code-generated protocol readers pre-size a collection from the element count declared by the sender. That count is checked only against bytes remaining in the request buffer, assuming about one byte per element, while most elements need several bytes. Affected ranges are 3.3.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The feed text is cut off before any fix.
Unconfirmed: The snippet ends before fixed versions or exploitation status.
- Severity is listed as important.
- Manikumar posted the report on October 28.
- Affected lines include 3.3.0–4.1.2, 4.2.0–4.2.1, and 4.3.0–4.3.1.
- The flaw is array allocation amplification in protocol readers.
Impact: Broker OutOfMemoryError from amplified array allocation
| Product | Affected |
|---|---|
| Apache Kafka | 3.3.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1 |
- CVEs
- CVE-2026-111108
- Vendors
- Apache
- Products
- Apache Kafka
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111108 | Broker heap exhaustion via array pre-allocation in Apache Kafka | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 3. 3. 0 through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.