CVE-2026-114349

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 4.2.2 Apache Kafka versions prior to 4.3.2 Apache Kafka versions prior to 4.4.0

Description When decoding a compressed record batch, the broker reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against available bytes or configured limits. Because this size is attacker-controlled and not constrained by the batch CRC, a small, valid compressed produce request can declare a body size up to 2 GiB, forcing an allocation that triggers an OutOfMemoryError. This can lead to a denial of service by crashing broker request-handler threads, consumers fetching the record, or the broker JVM if started with -XX:+ExitOnOutOfMemoryError. Additionally, a crafted record written to disk can terminate the log-cleaner thread during compaction on a compacted topic, halting log compaction for the entire broker, including internal topics like consumer offsets and transaction state, persisting across restarts.

Recommendations Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0 and set max.decompressed.message.bytes at the broker or topic level to a bounded value appropriate for the workload. Restrict Write access to trusted producers as a temporary measure until the upgrade and configuration are complete.