Kafka PushTelemetry decompression can OOM a broker (CVE-2026-111073)
Original title: CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
Only the compressed size is checked against telemetry.max.bytes, default 1 MB, before an unbounded decompress.
CVE-2026-111073 is a moderate broker denial of service in the PushTelemetry API from KIP-714. The broker checks the compressed metrics payload against telemetry.max.bytes, default 1 MB, then ClientTelemetryUtils.decompress() expands it with no output-size limit. Affected versions listed are Apache Kafka 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0. The snippet ends during the decompression description.
Unconfirmed: No fixed version or exploitation status is included in the truncated advisory.
- Vendor severity is moderate.
- The default telemetry.max.bytes value stated is 1 MB.
- Decompression grows output with no stated size cap.
- Apache Kafka 4.3.0 is listed without a through-range.
Impact: broker out-of-memory denial of service
| Product | Affected |
|---|---|
| Apache Kafka | 3.7.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 |
- CVEs
- CVE-2026-111073
- Vendors
- Apache
- Products
- Apache Kafka
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111073 | Unbounded decompression DoS in Apache Kafka PushTelemetry | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 3. 7. 0 through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.