Dawit Jeong

The broker-side PushTelemetry API validates only the compressed size of a client's metrics payload against the `telemetry.max.bytes` variable before decompression. The `ClientTelemetryUtils.decompress()` function then decompresses the payload without limiting the output size, which allows a small, highly compressible payload to expand into hundreds of megabytes of broker heap. An authenticated client can exploit this by sending requests that consume excessive heap memory, potentially leading to an `OutOfMemoryError` that can degrade or crash the broker and affect cluster availability. This API is available to any authenticated client and is not restricted by an Access Control List (ACL).

Improper Input Validation occurs in Apache Tomcat, which can lead to security issues when the software fails to properly validate input data.

HTTP response splitting occurs in multiple Apache HTTP Server modules when interacting with untrusted or compromised backend servers. This issue allows an attacker to split an HTTP response, potentially leading to cache poisoning or cross-site scripting.