CVE-2026-111073

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...

EUVD-2026-112168

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...

CVE-2026-111073 Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...

CVE-2026-111073

Apache Kafka is vulnerable to a denial-of-service (DoS) attack via the broker-side PushTelemetry API (KIP-714) . The ClientTelemetryUtils.decompress() function fails to limit the output size of decompressed metrics payloads, validating only the compressed size against telemetry.max.bytes (default...

PT-2026-128291

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...