Kafka deserializers can exhaust memory from a size field (CVE-2026-111551)
Original title: CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
Apache calls the flaw important: a small input can declare a huge size and force a large allocation.
CVE-2026-111551 is an unbounded-allocation denial of service in Kafka Streams and client deserializers. Several paths read a size or count from input and allocate an array, collection, or byte buffer without checking bytes actually available. Affected ranges are Apache Kafka 0.10.0.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The posted text stops before naming a patch.
Unconfirmed: Exploitation and the fixed versions are not stated in the truncated post.
- Vendor severity is important.
- Allocation uses the declared size with no available-bytes check.
- Kafka Streams and client deserializers are both named.
- No fixed release appears in the snippet.
Impact: denial of service via unbounded memory allocation
| Product | Affected |
|---|---|
| Apache Kafka | 0.10.0.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1 |
- CVEs
- CVE-2026-111551
- Vendors
- Apache
- Products
- Apache KafkaKafka Streams
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111551 | Unbounded allocation DoS in Apache Kafka Streams and client deserializers | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 0. 10. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.