CVE-2026-111073

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111073", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-15T13:40:49.926Z", "datePublished": "2026-10-28T16:37:58.482Z", "dateUpdated": "2026-11-05T19:15:28.351Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:37:58.482Z"}, "title": "Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service", "problemTypes": [{"descriptions": [{"description": "CWE-409 Improper handling of highly compressed data (data amplification)", "lang": "en", "cweId": "CWE-409", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-770 Allocation of resources without limits or throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "cweId": "CWE-400", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka", "versions": [{"status": "affected", "version": "3.7.0", "lessThanOrEqual": "4.1.2", "versionType": "semver"}, {"status": "affected", "version": "4.2.0", "lessThanOrEqual": "4.2.1", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.kafka:kafka"}], "descriptions": [{"value": "The broker-side PushTelemetry API (KIP-714) validates only the compressed size of\u00a0a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing\u00a0it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the\u00a0decompressed output size, growing a heap buffer until the compressed input is exhausted. A\u00a0small, highly compressible payload (for example gzip-compressed zeros) can therefore expand\u00a0to hundreds of megabytes of broker heap.\n\n\nImpact:\n\n\nAn authenticated client can send a PushTelemetry request with a small compressed payload that\u00a0decompresses to a very large size, consuming broker heap out of proportion to the request\u00a0size. Repeated or concurrent requests can exhaust the broker heap and cause an\u00a0OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers\u00a0can affect cluster availability. PushTelemetry is available to any authenticated client and is\u00a0not gated by an ACL.\n\n\nMitigation:\n\n\nUpgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully\u00a0prevents the amplification, because telemetry.max.bytes bounds only the compressed size;\u00a0lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a\u00a0partial mitigation.\n\n\nResolution:\n\n\n- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed\u00a0size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and\u00a0aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an\u00a0over-large or highly compressible payload is rejected instead of being fully expanded in\u00a0heap. The decompressed size is therefore bounded by default.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The broker-side PushTelemetry API (KIP-714) validates only the compressed size of&nbsp;<span>a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing&nbsp;</span><span>it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the&nbsp;</span><span>decompressed output size, growing a heap buffer until the compressed input is exhausted. A&nbsp;</span><span>small, highly compressible payload (for example gzip-compressed zeros) can therefore expand&nbsp;</span><span>to hundreds of megabytes of broker heap.</span></div><br><div>Impact:</div><br><div>An authenticated client can send a PushTelemetry request with a small compressed payload that&nbsp;<span>decompresses to a very large size, consuming broker heap out of proportion to the request&nbsp;</span><span>size. Repeated or concurrent requests can exhaust the broker heap and cause an&nbsp;</span><span>OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers&nbsp;</span><span>can affect cluster availability. PushTelemetry is available to any authenticated client and is&nbsp;</span><span>not gated by an ACL.</span></div><br><div>Mitigation:</div><br><div>Upgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully&nbsp;<span>prevents the amplification, because telemetry.max.bytes bounds only the compressed size;&nbsp;</span><span>lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a&nbsp;</span><span>partial mitigation.</span></div><br><div>Resolution:</div><br><div>- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed&nbsp;<span>size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and&nbsp;</span><span>aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an&nbsp;</span><span>over-large or highly compressible payload is rejected instead of being fully expanded in&nbsp;</span><span>heap. The decompressed size is therefore bounded by default.&nbsp;</span></div>"}]}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Dawit Jeong <dev.d4v1d@gmail.com>", "type": "reporter"}, {"lang": "en", "value": "Apoorv Mittal <apoorvmittal10@gmail.com>", "type": "remediation developer"}, {"lang": "en", "value": "Andrew Schofield <aschofield@confluent.io>", "type": "remediation reviewer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T20:06:51.327Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:15:23.902596Z", "id": "CVE-2026-111073", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:15:28.351Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T20:06:51.327Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-111073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:15:23.902596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:15:15.750Z"}}], "cna": {"title": "Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Dawit Jeong <dev.d4v1d@gmail.com>"}, {"lang": "en", "type": "remediation developer", "value": "Apoorv Mittal <apoorvmittal10@gmail.com>"}, {"lang": "en", "type": "remediation reviewer", "value": "Andrew Schofield <aschofield@confluent.io>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kafka", "versions": [{"status": "affected", "version": "3.7.0", "versionType": "semver", "lessThanOrEqual": "4.1.2"}, {"status": "affected", "version": "4.2.0", "versionType": "semver", "lessThanOrEqual": "4.2.1"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}], "packageURL": "pkg:maven/org.apache.kafka/kafka", "packageName": "org.apache.kafka:kafka", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://kafka.apache.org/cve-list", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "The broker-side PushTelemetry API (KIP-714) validates only the compressed size of\u00a0a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing\u00a0it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the\u00a0decompressed output size, growing a heap buffer until the compressed input is exhausted. A\u00a0small, highly compressible payload (for example gzip-compressed zeros) can therefore expand\u00a0to hundreds of megabytes of broker heap.\n\n\nImpact:\n\n\nAn authenticated client can send a PushTelemetry request with a small compressed payload that\u00a0decompresses to a very large size, consuming broker heap out of proportion to the request\u00a0size. Repeated or concurrent requests can exhaust the broker heap and cause an\u00a0OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers\u00a0can affect cluster availability. PushTelemetry is available to any authenticated client and is\u00a0not gated by an ACL.\n\n\nMitigation:\n\n\nUpgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully\u00a0prevents the amplification, because telemetry.max.bytes bounds only the compressed size;\u00a0lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a\u00a0partial mitigation.\n\n\nResolution:\n\n\n- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed\u00a0size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and\u00a0aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an\u00a0over-large or highly compressible payload is rejected instead of being fully expanded in\u00a0heap. The decompressed size is therefore bounded by default.", "supportingMedia": [{"type": "text/html", "value": "<div>The broker-side PushTelemetry API (KIP-714) validates only the compressed size of&nbsp;<span>a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing&nbsp;</span><span>it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the&nbsp;</span><span>decompressed output size, growing a heap buffer until the compressed input is exhausted. A&nbsp;</span><span>small, highly compressible payload (for example gzip-compressed zeros) can therefore expand&nbsp;</span><span>to hundreds of megabytes of broker heap.</span></div><br><div>Impact:</div><br><div>An authenticated client can send a PushTelemetry request with a small compressed payload that&nbsp;<span>decompresses to a very large size, consuming broker heap out of proportion to the request&nbsp;</span><span>size. Repeated or concurrent requests can exhaust the broker heap and cause an&nbsp;</span><span>OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers&nbsp;</span><span>can affect cluster availability. PushTelemetry is available to any authenticated client and is&nbsp;</span><span>not gated by an ACL.</span></div><br><div>Mitigation:</div><br><div>Upgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully&nbsp;<span>prevents the amplification, because telemetry.max.bytes bounds only the compressed size;&nbsp;</span><span>lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a&nbsp;</span><span>partial mitigation.</span></div><br><div>Resolution:</div><br><div>- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed&nbsp;<span>size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and&nbsp;</span><span>aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an&nbsp;</span><span>over-large or highly compressible payload is rejected instead of being fully expanded in&nbsp;</span><span>heap. The decompressed size is therefore bounded by default.&nbsp;</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409 Improper handling of highly compressed data (data amplification)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-28T16:37:58.482Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111073", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:15:28.351Z", "dateReserved": "2026-10-15T13:40:49.926Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-28T16:37:58.482Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.kafka:kafka", "packageURL": "pkg:maven/org.apache.kafka/kafka", "product": "Apache Kafka", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "4.1.2", "status": "affected", "version": "3.7.0", "versionType": "semver"}, {"lessThanOrEqual": "4.2.1", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The broker-side PushTelemetry API (KIP-714) validates only the compressed size of\u00a0a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing\u00a0it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the\u00a0decompressed output size, growing a heap buffer until the compressed input is exhausted. A\u00a0small, highly compressible payload (for example gzip-compressed zeros) can therefore expand\u00a0to hundreds of megabytes of broker heap.\n\n\nImpact:\n\n\nAn authenticated client can send a PushTelemetry request with a small compressed payload that\u00a0decompresses to a very large size, consuming broker heap out of proportion to the request\u00a0size. Repeated or concurrent requests can exhaust the broker heap and cause an\u00a0OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers\u00a0can affect cluster availability. PushTelemetry is available to any authenticated client and is\u00a0not gated by an ACL.\n\n\nMitigation:\n\n\nUpgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully\u00a0prevents the amplification, because telemetry.max.bytes bounds only the compressed size;\u00a0lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a\u00a0partial mitigation.\n\n\nResolution:\n\n\n- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed\u00a0size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and\u00a0aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an\u00a0over-large or highly compressible payload is rejected instead of being fully expanded in\u00a0heap. The decompressed size is therefore bounded by default."}], "id": "CVE-2026-111073", "lastModified": "2026-11-05T20:17:41.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111073", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:15:23.902596Z", "version": "2.0.3"}}]}, "published": "2026-10-28T17:17:38.300", "references": [{"source": "security@apache.org", "url": "https://kafka.apache.org/cve-list"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/11"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-409"}, {"lang": "en", "value": "CWE-770"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.kafka/kafka-clients: Apache Kafka: Denial of Service via unbounded telemetry payload decompression", "id": "2562957", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562957"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-409", "details": ["The broker-side PushTelemetry API (KIP-714) validates only the compressed size of\u00a0a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing\u00a0it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the\u00a0decompressed output size, growing a heap buffer until the compressed input is exhausted. A\u00a0small, highly compressible payload (for example gzip-compressed zeros) can therefore expand\u00a0to hundreds of megabytes of broker heap.\nImpact:\nAn authenticated client can send a PushTelemetry request with a small compressed payload that\u00a0decompresses to a very large size, consuming broker heap out of proportion to the request\u00a0size. Repeated or concurrent requests can exhaust the broker heap and cause an\u00a0OutOfMemoryError, degrading or crashing the broker; a client that targets multiple brokers\u00a0can affect cluster availability. PushTelemetry is available to any authenticated client and is\u00a0not gated by an ACL.\nMitigation:\nUpgrade to Apache Kafka 4.2.2, 4.3.1, or 4.4.0. On affected versions there is no configuration that fully\u00a0prevents the amplification, because telemetry.max.bytes bounds only the compressed size;\u00a0lowering telemetry.max.bytes reduces the worst-case decompressed size proportionally and is a\u00a0partial mitigation.\nResolution:\n- From Apache Kafka 4.2.2, 4.3.1, and 4.4.0: ClientTelemetryUtils.decompress() enforces a maximum decompressed\u00a0size equal to telemetry.max.bytes (default 1 MB). Decompression reads in bounded chunks and\u00a0aborts with a TelemetryTooLargeException once the decompressed total exceeds the limit, so an\u00a0over-large or highly compressible payload is rejected instead of being fully expanded in\u00a0heap. The decompressed size is therefore bounded by default.", "A flaw was found in Apache Kafka. The broker-side telemetry interface validates only the compressed size of incoming metrics payloads, failing to enforce a limit on the decompressed data size. An authenticated client can exploit this flaw by sending a small, highly compressed payload that expands dramatically during decompression. This excessive memory consumption can exhaust broker memory resources and crash the service, leading to a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Lower the `telemetry.max.bytes` configuration parameter on Kafka brokers to limit the size of compressed telemetry payloads processed into memory.\nIn the Kafka broker configuration file (`server.properties`), set a reduced value for the telemetry payload limit (for example, 100 KB):\ntelemetry.max.bytes=102400\nCaveats:\nThis provides a partial mitigation. Decreasing this parameter reduces the worst-case decompressed heap allocation proportionally, but does not completely eliminate memory amplification. In addition, legitimate clients transmitting valid telemetry metrics exceeding this configured limit will be rejected.\nWarning: Modifying the broker configuration requires restarting the Kafka broker service, which can cause temporary service interruption if not performed in a rolling restart fashion across the cluster."}, "name": "CVE-2026-111073", "package_state": [{"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Fix deferred", "package_name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Fix deferred", "package_name": "kafka-clients", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "kafka-clients", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "kafka-clients", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "kafka-clients", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Fix deferred", "package_name": "kafka-clients", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "kafka-clients", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "kafka-clients", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-10-28T16:37:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111073\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111073\nhttps://kafka.apache.org/cve-list"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires an authenticated client and only causes a denial of service, without compromising system confidentiality or data integrity. In typical Red Hat deployments containing Apache Kafka brokers, telemetry intake is exposed to all authenticated connections without access control list enforcement. A malicious or compromised authenticated user can transmit highly compressible metrics data that expands upon decompression, exhausting broker heap memory and degrading cluster stability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.7.0,4.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Kafka", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "kafka", "vendor": "apache"}], "created": "2026-10-28T17:30:15.427394+00:00", "updated": "2026-10-30T01:30:06.742628+00:00", "vendors": ["apache", "apache$PRODUCT$kafka"], "weaknesses": ["CWE-400", "CWE-409", "CWE-770"]}