CVE-2026-111073

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...