CVE-2026-111551

A flaw was found in Apache Kafka. Several deserialization routines in the client and Streams libraries allocate memory directly based on an input's declared size field without validating whether enough data is actually available. An attacker who can send crafted messages to affected topics or...