EUVD-2026-112170

Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size socket.request.max.bytes; it was not checked against the...

CVE-2026-111115

Apache Kafka is vulnerable to a Broker OutOfMemoryError due to a tagged-field allocation amplification in flexible protocol request parsing. The issue arises because code-generated readers for flexible protocol versions parse a tagged-field count declared by the sender without verifying it agains...