Denial of Service Vulnerability in Apache Kafka Flexible Protocol Readers
CVE-2026-111115

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Kafka
Vendor
CVE Published:
28 October 2026

What is CVE-2026-111115?

Apache Kafka features a vulnerability in its parsing of flexible protocol version headers, which allows for excessive allocation of resources based on tagged fields sent in requests. An attacker can exploit this by sending a request with a substantial number of tagged fields, potentially overloading the broker's heap memory and inducing process-wide garbage collection stalls. This manipulation occurs before authentication, bypassing ACL and quota restrictions, which can lead to service denial.

Affected Version(s)

Apache Kafka 2.4.0 <= 4.1.2

Apache Kafka 4.2.0 <= 4.2.1

Apache Kafka 4.3.0 <= 4.3.1

References

https://kafka.apache.org/cve-list
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mufeed VH <mufeed@winfunc.com>
Vivek R <vivek@winfunc.com>
Shay Elkin <selkin@confluent.io>
.