Threat reportVulnerabilityTL-2026-4668

Apache Kafka Unbounded Memory Allocation Zero-Days (CVE-2026-114349, CVE-2026-111551) — Compressed Batch Decoding and Kafka Streams Deserializers

highPATCHED

Apache Kafka Unbounded Memory Allocation Zero-Days (TL-2026-4668) is a high-severity software vulnerability, first published 2026-10-28. It has no confirmed attribution, affects Apache Software Foundation Apache Kafka (compressed record batch, references 2 CVEs (CVE-2026-114349, CVE-2026-111551), maps to 4 MITRE ATT&CK techniques (T1078, T1190, T1489), and is covered by 9 detection rules and 10 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
2Referenced vulnerabilities
Techniques
4MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
10Indicators of compromise

Key facts for TL-2026-4668

Threat ID
TL-2026-4668
Severity
HIGH
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, finance, telecoms, retail, government administration
Target regions
Global
Detection rules
9
Indicators of compromise
10

How Apache Kafka Unbounded Memory Allocation Zero-Days works

Two Apache Kafka vulnerabilities (CWE-789/CWE-770) allow small crafted inputs to force multi-gigabyte allocations: one in broker/consumer compressed record batch decoding (CVE-2026-114349) and one in client and Kafka Streams deserializers (CVE-2026-111551). Both affect Kafka 0.10.0.0/0.11.0.0 through 4.3.1 and are fixed in 4.2.2, 4.3.2 and 4.4.0; no in-the-wild exploitation is reported.

Endor Labs' AI SAST engine traced untrusted size fields across module boundaries and identified three unbounded allocation sites in Apache Kafka in a single scan on 2026-05-01. The findings were reported to the Apache Kafka security team with reproducers on 2026-05-15, and the CVE advisories and NVD records were published on 2026-10-28. The Apache Kafka CVE list credits multiple reporters. For CVE-2026-114349 these are Peyton Kennedy, Trung Nguyen (CyStack), Bartłomiej Dmitruk (Striga), 임성민, Mike Read, Salman Aljardan, Yuchao Zhang, Yu Bao (PayPal) and Vamsi K, with remediation by Srinivas Akhil Mallela. For CVE-2026-111551 they are Peyton Kennedy, Bartłomiej Dmitruk (Striga) and Mike Read, with remediation by Matthias J. Sax and Lucy Liu.

CVE-2026-114349 (CWE-789, CWE-770; the NVD record lists CWE-400, CWE-789 and CWE-1284) affects compressed record batch decoding. In clients/src/main/java/org/apache/kafka/common/record/internal/DefaultRecord.java (around lines 280-287), the InputStream-based decoder reads a varint sizeOfBodyInBytes from the decompressed stream and calls ByteBuffer.allocate() on it without bounds validation. Per Endor Labs, the sibling ByteBuffer overload performs the validation that this method lacks. A crafted produce request of roughly 90 bytes, with a mismatched compression type, can declare a body of up to about 2 GiB. The result is a consumer crash on fetch, an OutOfMemoryError in broker request-handler threads (the broker JVM terminates when run with -XX:+ExitOnOutOfMemoryError), and death of the log cleaner thread, which permanently halts compaction on compacted topics across the broker. The NVD record describes the attacker as an authenticated principal with Write permission. Fixed releases add the max.decompressed.message.bytes limit. Per Endor Labs it defaults to roughly 2 GiB (effectively unlimited, for backward compatibility), so operators must set a bounded value.

CVE-2026-111551 (CWE-789, CWE-770; the NVD record lists CWE-20, CWE-400 and CWE-789) covers multiple deserialization paths in Kafka clients and Kafka Streams that read a size or count field and allocate an array, collection or buffer before checking the bytes actually available. Affected paths include ListDeserializer.deserializeNullIndexList (lines ~152-153), ConsumerProtocolUtils.readTaskIdFrom, AssignmentInfo (decodeActiveTasks, decodeStandbyTasks, decodePartitionsByHost, readTopicPartitions, decodeTopicIndexAndGet), ProcessorRecordContext header-count parsing, ChangedDeserializer varint value length, CombinedKeySchema foreign-key length and ProcessorMetadata key length. A 9-byte record crashes consumers that use ListSerde, which requires write access to the topic. A 12-byte crafted Streams assignment crashes every Kafka Streams instance in a consumer group; the assignment bytes originate from the consumer group leader via the SyncGroup response, so this requires consumer group membership. Per NVD, malicious records in internal topics, offset metadata or group assignment data cause OutOfMemoryError in consumer or Streams threads, and the broker itself is not affected by this CVE.

Exploitation requires network access to the cluster plus either Write permission on a topic or consumer group membership. Researcher PoC payloads are described in the Endor Labs write-up. The sources do not state in-the-wild exploitation, CVSS scores, or network IOCs. The CISA KEV feed was checked and no listing was found in the portion read. The HIGH severity rating is an analyst estimate, based on the availability impact and the authenticated-write precondition. It is not a vendor rating.

MITRE ATT&CK techniques used in TL-2026-4668

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Impact

T1489 Service Stop; T1499.004 Endpoint Denial of Service: Application or System Exploitation

Affected products and versions in Apache Kafka Unbounded Memory Allocation Zero-Days

  • Apache Software Foundation — Apache Kafka (compressed record batch decoding, CVE-2026-114349)
    Vulnerable versions: 0.11.0.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1
    Fixed in: 4.2.2; 4.3.2; 4.4.0 (requires max.decompressed.message.bytes configuration)
  • Apache Software Foundation — Apache Kafka clients and Kafka Streams (deserializers, CVE-2026-111551)
    Vulnerable versions: 0.10.0.0 through 4.1.2; 4.2.0 through 4.2.1; 4.3.0 through 4.3.1
    Fixed in: 4.2.2; 4.3.2; 4.4.0

Remediation for Apache Kafka Unbounded Memory Allocation Zero-Days

Patches

  • Upgrade Apache Kafka to 4.2.2, 4.3.2 or 4.4.0

Immediate actions

  • Restrict Write ACLs on topics to trusted producers only
  • Restrict access to consumer groups and internal topics used by Kafka Streams
  • Alert on JMX metric kafka.log:type=LogCleaner,name=DeadThreadCount > 0
  • Set max.decompressed.message.bytes at broker/topic level to a bounded value appropriate for the workload

Workarounds

  • Configure max.decompressed.message.bytes (needed for CVE-2026-114349 even on fixed versions, since the default is about 2 GiB)
  • Limit network exposure of Kafka brokers and enforce authentication and authorization

Longer-term hardening

  • Run brokers with -XX:+ExitOnOutOfMemoryError under a supervisor that restarts them, and monitor JVM heap and OOM events
  • Avoid ListSerde and similar deserializers on topics that untrusted producers can write to

CVEs associated with Apache Kafka Unbounded Memory Allocation Zero-Days

CVE-2026-114349, CVE-2026-111551

Weaknesses (CWE) in Apache Kafka Unbounded Memory Allocation Zero-Days

CWE-789, CWE-770, CWE-400, CWE-1284, CWE-20

Timeline of Apache Kafka Unbounded Memory Allocation Zero-Days

  • Endor Labs AI SAST identifies all three unbounded allocation findings in a single scan of Apache Kafka
  • Findings reported to the Apache Kafka security team with reproducers
  • Endor Labs publishes technical write-up with PoC payloads and mitigations
  • NVD publishes CVE-2026-114349 (17:17 UTC) with CWE-400, CWE-789 and CWE-1284; no CVSS score assigned
  • NVD publishes CVE-2026-111551 (17:17 UTC) with CWE-20, CWE-400 and CWE-789; no CVSS score assigned
  • Fixes available in Apache Kafka 4.2.2, 4.3.2 and 4.4.0; max.decompressed.message.bytes introduced for broker-side limiting
  • Apache Kafka announces CVE-2026-114349 and CVE-2026-111551 on its CVE list, crediting multiple reporters

Sources cited for Apache Kafka Unbounded Memory Allocation Zero-Days

Detection coverage for TL-2026-4668

As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4668 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
10 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats