Buffer Allocation Vulnerability in Apache Kafka by Confluent
CVE-2026-114349

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Kafka
Vendor
CVE Published:
28 October 2026

What is CVE-2026-114349?

A vulnerability in Apache Kafka's handling of compressed record batches can lead to denial of service. When a broker processes a compressed message, it may attempt to allocate a buffer based on an attacker-controlled size declaration from the incoming data stream. This can result in an OutOfMemoryError, causing broker request-handler threads to crash. If this occurs, any consumer fetching the records can be denied service. The issue can persist after a restart, as the problematic record remains in the disk log, halting background tasks like log compaction. Operators are advised to upgrade to specific versions and set proper size constraints to prevent exploitation.

Affected Version(s)

Apache Kafka 0.11.0.0 <= 4.1.2

Apache Kafka 4.2.0 <= 4.2.1

Apache Kafka 4.3.0 <= 4.3.1

References

https://kafka.apache.org/cve-list
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peyton Kennedy <pkennedy@endor.ai>
Trung Nguyen <trungnh@cystack.net>, CyStack
Bartłomiej Dmitruk <bartek@striga.ai>, Striga
임성민 <at_haemil@naver.com>
Mike Read (GitHub: Michael-JRead)
Salman Aljardan <salman1aljardan@gmail.com>
Yuchao Zhang <ndaugoing@gmail.com>
Yu Bao <yubao@paypal.com>, PayPal Cyber Security Team
Vamsi K <xh081ix@gmail.com>
Srinivas Akhil Mallela <srinivasakhil@gmail.com>
.