Apache Kafka DoS via unbounded allocation on compressed batches (CVE-2026-114349)
Original title: CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Brokers from 0.11.0.0 through the listed 4.3.1 builds allocate an attacker-chosen buffer before validating decompressed data.
Apache rates CVE-2026-114349 important. When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before checking available bytes or any configured limit. The size is attacker-controlled. The posted description is cut off, and no fixed release is named.
Unconfirmed: The description is truncated, and no fixed version is stated.
- Severity is listed as important.
- Affected ranges are 0.11.0.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1.
- Allocation happens before validation against available bytes or a configured limit.
- No exploitation or fixed version is stated in the snippet.
Impact: Denial of service through unbounded memory allocation
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Kafka | 0.11.0.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1 |
- CVEs
- CVE-2026-114349
- Vendors
- Apache Software Foundation
- Products
- Apache Kafka
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114349 | Unbounded allocation DoS in Apache Kafka compressed records | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 0. 11. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.