CVE-2026-111073

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 4.2.2 Apache Kafka versions prior to 4.3.1 Apache Kafka versions prior to 4.4.0

Description The broker-side PushTelemetry API validates only the compressed size of a client's metrics payload against the telemetry.max.bytes variable before decompression. The ClientTelemetryUtils.decompress() function then decompresses the payload without limiting the output size, which allows a small, highly compressible payload to expand into hundreds of megabytes of broker heap. An authenticated client can exploit this by sending requests that consume excessive heap memory, potentially leading to an OutOfMemoryError that can degrade or crash the broker and affect cluster availability. This API is available to any authenticated client and is not restricted by an Access Control List (ACL).

Recommendations Upgrade to version 4.2.2. Upgrade to version 4.3.1. Upgrade to version 4.4.0. As a partial mitigation, lower the telemetry.max.bytes value to reduce the worst-case decompressed size.