CVE-2026-111108

Apache Kafka is vulnerable to a memory exhaustion flaw in its code-generated protocol readers. The root cause is that readers pre-size collections based on a sender-declared element count that is only validated against the remaining buffer bytes. This allows an attacker to declare a count far exc...