CVE-2026-111551

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 4.2.2 Apache Kafka versions prior to 4.3.2 Apache Kafka versions prior to 4.4.0

Description Several deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer without verifying the available bytes. A small crafted input can declare an excessively large size, forcing a multi-gigabyte allocation. This can lead to an OutOfMemoryError, crashing the affected consumer or Kafka Streams thread, though the broker and cluster remain unaffected. The issue persists across restarts because the crafted record remains in the topic. The max.message.bytes limit is ineffective as the allocation is based on the size field rather than the actual input length. Affected paths include ProcessorRecordContext (header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length), ProcessorMetadata (key length), and AssignmentInfo group-assignment decoding within Kafka Streams, as well as ListDeserializer (used by ListSerde) in the clients library.

Recommendations Upgrade to Apache Kafka version 4.2.2. Upgrade to Apache Kafka version 4.3.2. Upgrade to Apache Kafka version 4.4.0. Restrict write access to each application's internal topics and consumer group to its own principal where authorization is enabled. Restrict which users can produce to topics consumed with ListSerde.