CVE-2026-111108

Overview

Apache Kafka is an open-source distributed event streaming platform used for high-throughput, fault-tolerant data pipelines and stream processing. It stores records in partitioned, replicated, append-only logs on a cluster of brokers, and exposes producer, consumer, admin, Streams, and Connect APIs for publishing, subscribing to, and processing those records. The Java client and server components are published as Maven artifacts under org.apache.kafka.

A denial of service vulnerability (CVE-2026-111108) has been identified in the code-generated protocol readers of Apache Kafka, which allows attackers to crash a broker with an OutOfMemoryError by sending requests that declare very large array lengths. Because request parsing happens before any authorization check, an unauthenticated attacker can trigger it on a listener that does not require authentication.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache Kafka.

Details

Module Info

• Product: Apache Kafka
• Affected packages: org.apache.kafka:kafka-clients
• Affected versions: >=3.3.0 <=4.1.2, >=4.2.0 <=4.2.1, >=4.3.0 <=4.3.1
• GitHub repository: https://github.com/apache/kafka
• Published packages: https://central.sonatype.com/artifact/org.apache.kafka/kafka-clients
• Package manager: Maven
• Fixed in:
  • OSS Apache Kafka 4.2.2, 4.3.2, 4.4.0
  • NES for Apache Kafka v3.1.5

Vulnerability Info

This High-severity vulnerability is found in the org.apache.kafka:kafka-clients package in multiple versions of Apache Kafka. Kafka's request and response classes are generated at build time by MessageDataGenerator, and every generated reader for an array field reads the element count declared by the sender and then pre-sizes the target collection from it. The only guard compares that count with the number of bytes left in the request buffer:

buffer.printf("if (%s > _readable.remaining()) {%n", lengthVar);
buffer.incrementIndent();
buffer.printf("throw new RuntimeException(\"Tried to allocate a collection of size \" + %s + \", but " +
        "there are only \" + _readable.remaining() + \" bytes remaining.\");%n", lengthVar);
buffer.decrementIndent();
buffer.printf("}%n");
if (isStructArrayWithKeys) {
    headerGenerator.addImport(MessageGenerator.IMPLICIT_LINKED_HASH_MULTI_COLLECTION_CLASS);
    buffer.printf("%s newCollection = new %s(%s);%n",
        FieldSpec.collectionType(arrayType.elementType().toString()),
            FieldSpec.collectionType(arrayType.elementType().toString()), lengthVar);
} else {
    headerGenerator.addImport(MessageGenerator.ARRAYLIST_CLASS);
    String boxedArrayType =
        arrayType.elementType().getBoxedJavaType(headerGenerator);
    buffer.printf("ArrayList<%s> newCollection = new ArrayList<>(%s);%n", boxedArrayType, lengthVar);
}

The remaining-bytes check assumes roughly one byte per element, but most elements take several bytes on the wire, so a request can declare far more elements than it actually carries and still pass. For a keyed array the generated code then allocates an ImplicitLinkedHashCollection with a capacity of about twice the declared count before a single element is read, and for other arrays an ArrayList of the declared size. Since the pattern is emitted into every generated reader, it is reachable through every Kafka API type with an array field.

The broker parses the request body before it checks authorization, so on a listener without authentication (for example PLAINTEXT) any client that can connect can send it, and on authenticated listeners valid credentials are enough, with no specific ACL needed. The reporter showed that three concurrent ProduceRequest (v3) connections of about 90 MB each exhaust a 1 GB broker heap, an amplification of about eight times the wire size, which crashes the broker with an OutOfMemoryError.

Mitigation

Only recent versions of Apache Kafka are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. The Apache Kafka project does bugfix releases only for the last three minor releases; see the project's time-based release plan.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Kafka to a currently supported release that contains the fix, such as 4.2.2.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Mike Read (finder)