CVE-2026-111108

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111108 Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111108

Apache Kafka is vulnerable to a memory exhaustion flaw in its code-generated protocol readers. The root cause is that readers pre-size collections based on a sender-declared element count that is only validated against the remaining buffer bytes. This allows an attacker to declare a count far exc...