Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Multiple CVEs in Apache Kafka enable broker DoS and hangs

1 source · 5 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Five new CVEs allow unbounded memory allocations, decompression, and overflows in Apache Kafka and Kafka Streams.

Five denial-of-service and hang vulnerabilities in Apache Kafka were disclosed on oss-security. CVE-2026-111073 lets a broker OOM via unbounded decompression of telemetry payloads after a 1 MB compressed-size check. CVE-2026-111115 and CVE-2026-114349 enable OOM through unbounded tagged-field retention and pre-validation buffer allocation in compressed batches. CVE-2026-111551 causes DoS in Kafka Streams and deserializers from unchecked size-based allocations. CVE-2026-111496 produces hangs from integer overflow when adding timestamps near Long.MAX_VALUE to missed intervals. Affected versions span 0.10.0.0 through 4.3.1; no patches are named.

Key facts
  • CVE-2026-111073: unbounded telemetry decompression after 1 MB check, moderate
  • CVE-2026-111115: OOM via unlimited RawTaggedField retention, important
  • CVE-2026-111551: unbounded alloc in Streams/deserializers, important
  • CVE-2026-111496: StreamThread hang from timestamp overflow, low
  • CVE-2026-114349: OOM from pre-validation buffer alloc, important
  • Versions: 0.10.0–4.3.1 across CVEs
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026oss-security reports CVE-2026-111073 on unbounded telemetry decompression · oss-security
  2. Oct 28, 2026oss-security reports CVE-2026-111115 on tagged-field OOM · oss-security
  3. Oct 28, 2026oss-security reports CVE-2026-111551 on unbounded Streams allocation · oss-security
  4. Oct 28, 2026oss-security reports CVE-2026-111496 on punctuation overflow · oss-security
  5. Oct 28, 2026oss-security reports CVE-2026-114349 on compressed batch allocation · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityDetails for five distinct CVEs with versions, severities, and technical descriptions
CVEs
CVE-2026-114349CVE-2026-111115CVE-2026-111551CVE-2026-111073CVE-2026-111496
Vendors
Apache Software FoundationApache
Products
Apache KafkaKafka Streams

Coverage

oldest first · one row per article · UTC
  1. · 14d ago oss-securityFirst report

    Kafka PushTelemetry decompression can OOM a broker (CVE-2026-111073)

    Only the compressed size is checked against telemetry.max.bytes, default 1 MB, before an unbounded decompress.

  2. · 14d ago oss-security

    Kafka brokers can OOM on tagged-field counts (CVE-2026-111115)

    Flexible-protocol readers keep a RawTaggedField per unknown field, with the count limited only by the request frame.

  3. · 14d ago oss-security

    Kafka deserializers can exhaust memory from a size field (CVE-2026-111551)

    Apache calls the flaw important: a small input can declare a huge size and force a large allocation.

  4. · 14d ago oss-security

    Kafka Streams can hang on punctuation integer overflow (CVE-2026-111496)

    A record timestamp near Long.MAX_VALUE can overflow the next punctuation time and stall a StreamThread.

  5. · 14d ago oss-security

    Apache Kafka DoS via unbounded allocation on compressed batches (CVE-2026-114349)

    Brokers from 0.11.0.0 through the listed 4.3.1 builds allocate an attacker-chosen buffer before validating decompressed data.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111551
+2 related CVEs
CVE-2026-111073CVE-2026-114349
Unbounded allocation DoS in Apache Kafka Streams and client deserializers
7.5
group max
—
CVE-2026-111115
Unauthenticated heap DoS in Apache Kafka flexible headers
9.1—
CVE-2026-111496
Integer overflow hang in Kafka Streams stream-time punctuation
9.1—