Kafka Deserialization Vulnerability in Apache Kafka Products
CVE-2026-111551

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Kafka
Vendor
CVE Published:
28 October 2026

What is CVE-2026-111551?

A vulnerability in Apache Kafka allows for exploitation through deserialization paths that lack proper validation of input data. Attackers can craft input that specifies an excessively large size or count, leading to a potential OutOfMemoryError, thereby crashing the affected consumer or Kafka Streams thread. Notably, this issue affects various components, including ProcessorRecordContext, ChangedDeserializer, and ListDeserializer, as well as internal topics and consumer groups. Mitigation steps include upgrading to versions 4.2.2, 4.3.2, or 4.4.0, which implement necessary validations against the input data size, ensuring secure and stable Kafka operations.

Affected Version(s)

Apache Kafka 0.10.0.0 <= 4.1.2

Apache Kafka 4.2.0 <= 4.2.1

Apache Kafka 4.3.0 <= 4.3.1

References

https://kafka.apache.org/cve-list
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peyton Kennedy <pkennedy@endor.ai>
Bartlomiej Dmitruk <bartek@striga.ai>
Mike Read (GitHub: Michael-JRead)
Matthias J. Sax <matthias@confluent.io>
Lucy Liu <lucliu@confluent.io>
.