Heap Buffer Overflow Vulnerability in Apache Kafka's PushTelemetry API

CVE-2026-111073

What is CVE-2026-111073?

An authenticated client can exploit the PushTelemetry API in Apache Kafka by sending a small, highly compressible payload. This payload, when decompressed, significantly expands in size, leading to the exhaustion of the broker's heap memory. The lack of limits on the decompressed output size can cause an OutOfMemoryError, resulting in broker degradation or crashes, with potential impacts on cluster availability. In order to mitigate this issue, upgrading to versions 4.2.2, 4.3.1, or 4.4.0 is recommended, as these versions enforce limits on decompression to prevent heap buffer overflow.

References