# Apache Kafka Unbounded Memory Allocation Zero-Days (CVE-2026-114349, CVE-2026-111551) — Compressed Batch Decoding and Kafka Streams Deserializers

> Two Apache Kafka vulnerabilities (CWE-789/CWE-770) allow small crafted inputs to force multi-gigabyte allocations: one in broker/consumer compressed record batch decoding (CVE-2026-114349) and one in client and Kafka Streams deserializers (CVE-2026-111551). Both affect Kafka 0.10.0.0/0.11.0.0 through 4.3.1 and are fixed in 4.2.2, 4.3.2 and 4.4.0; no in-the-wild exploitation is reported.

- **Published:** 2026-10-28T19:55:31Z
- **Last reviewed:** 2026-10-28T19:55:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4668
- **ID:** TL-2026-4668
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-114349, CVE-2026-111551

## Description

Endor Labs' AI SAST engine traced untrusted size fields across module boundaries and identified three unbounded allocation sites in Apache Kafka in a single scan on 2026-05-01. The findings were reported to the Apache Kafka security team with reproducers on 2026-05-15, and the CVE advisories and NVD records were published on 2026-10-28. The Apache Kafka CVE list credits multiple reporters. For CVE-2026-114349 these are Peyton Kennedy, Trung Nguyen (CyStack), Bartłomiej Dmitruk (Striga), 임성민, Mike Read, Salman Aljardan, Yuchao Zhang, Yu Bao (PayPal) and Vamsi K, with remediation by Srinivas Akhil Mallela. For CVE-2026-111551 they are Peyton Kennedy, Bartłomiej Dmitruk (Striga) and Mike Read, with remediation by Matthias J. Sax and Lucy Liu.

CVE-2026-114349 (CWE-789, CWE-770; the NVD record lists CWE-400, CWE-789 and CWE-1284) affects compressed record batch decoding. In clients/src/main/java/org/apache/kafka/common/record/internal/DefaultRecord.java (around lines 280-287), the InputStream-based decoder reads a varint sizeOfBodyInBytes from the decompressed stream and calls ByteBuffer.allocate() on it without bounds validation. Per Endor Labs, the sibling ByteBuffer overload performs the validation that this method lacks. A crafted produce request of roughly 90 bytes, with a mismatched compression type, can declare a body of up to about 2 GiB. The result is a consumer crash on fetch, an OutOfMemoryError in broker request-handler threads (the broker JVM terminates when run with -XX:+ExitOnOutOfMemoryError), and death of the log cleaner thread, which permanently halts compaction on compacted topics across the broker. The NVD record describes the attacker as an authenticated principal with Write permission. Fixed releases add the max.decompressed.message.bytes limit. Per Endor Labs it defaults to roughly 2 GiB (effectively unlimited, for backward compatibility), so operators must set a bounded value.

CVE-2026-111551 (CWE-789, CWE-770; the NVD record lists CWE-20, CWE-400 and CWE-789) covers multiple deserialization paths in Kafka clients and Kafka Streams that read a size or count field and allocate an array, collection or buffer before checking the bytes actually available. Affected paths include ListDeserializer.deserializeNullIndexList (lines ~152-153), ConsumerProtocolUtils.readTaskIdFrom, AssignmentInfo (decodeActiveTasks, decodeStandbyTasks, decodePartitionsByHost, readTopicPartitions, decodeTopicIndexAndGet), ProcessorRecordContext header-count parsing, ChangedDeserializer varint value length, CombinedKeySchema foreign-key length and ProcessorMetadata key length. A 9-byte record crashes consumers that use ListSerde, which requires write access to the topic. A 12-byte crafted Streams assignment crashes every Kafka Streams instance in a consumer group; the assignment bytes originate from the consumer group leader via the SyncGroup response, so this requires consumer group membership. Per NVD, malicious records in internal topics, offset metadata or group assignment data cause OutOfMemoryError in consumer or Streams threads, and the broker itself is not affected by this CVE.

Exploitation requires network access to the cluster plus either Write permission on a topic or consumer group membership. Researcher PoC payloads are described in the Endor Labs write-up. The sources do not state in-the-wild exploitation, CVSS scores, or network IOCs. The CISA KEV feed was checked and no listing was found in the portion read. The HIGH severity rating is an analyst estimate, based on the availability impact and the authenticated-write precondition. It is not a vendor rating.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1489 Service Stop

## Sources

- [Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams](https://www.endorlabs.com/learn/endor-labs-ai-sast-finds-two-apache-kafka-zero-days-unbounded-memory-allocation-from-brokers-to-kafka-streams)
- [Apache Kafka CVE list](https://kafka.apache.org/community/cve-list/)
- [NVD - CVE-2026-114349](https://nvd.nist.gov/vuln/detail/CVE-2026-114349)
- [NVD - CVE-2026-111551](https://nvd.nist.gov/vuln/detail/CVE-2026-111551)
- [Apache Kafka security page](https://kafka.apache.org/community/security/)
- [Apache Kafka source: DefaultRecord.java](https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/record/internal/DefaultRecord.java)
- [NVD API record - CVE-2026-114349](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-114349)
- [NVD API record - CVE-2026-111551](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111551)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4668