Kafka brokers can OOM on tagged-field counts (CVE-2026-111115)
Original title: CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
Flexible-protocol readers keep a RawTaggedField per unknown field, with the count limited only by the request frame.
Apache rates CVE-2026-111115 important. Code-generated readers for flexible protocol versions take a sender-declared tagged-field count and retain a RawTaggedField for each unknown field. That count was bounded only by socket.request.max.bytes, not checked further in the snippet. Listed versions are Apache Kafka 2.4.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1.
Unconfirmed: The snippet does not confirm attacks in the wild or name a patched release.
- Impact described is a broker OutOfMemoryError.
- The count bound cited is socket.request.max.bytes.
- Unknown tagged fields are retained as RawTaggedField objects.
- The post is cut off before any fix.
Impact: broker OutOfMemoryError from tagged-field allocation
| Product | Affected |
|---|---|
| Apache Kafka | 2.4.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1 |
- CVEs
- CVE-2026-111115
- Vendors
- Apache
- Products
- Apache Kafka
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111115 | Unauthenticated heap DoS in Apache Kafka flexible headers | — | — |
From the original article
Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 2. 4. 0 through 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.