{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-28T20:06:57.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/28/13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.kafka:kafka-streams",
          "packageURL": "pkg:maven/org.apache.kafka/kafka-streams",
          "product": "Apache Kafka",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.1.2",
              "status": "affected",
              "version": "0.10.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.1",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.1",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.kafka:kafka-clients",
          "packageURL": "pkg:maven/org.apache.kafka/kafka-clients",
          "product": "Apache Kafka",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.1.2",
              "status": "affected",
              "version": "0.10.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.1",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.3.1",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peyton Kennedy \u003cpkennedy@endor.ai\u003e"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bartlomiej Dmitruk \u003cbartek@striga.ai\u003e"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mike Read (GitHub: Michael-JRead)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matthias J. Sax \u003cmatthias@confluent.io\u003e"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lucy Liu \u003clucliu@confluent.io\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eSeveral Kafka deserialization paths read a size or count field from input data and use it directly\u0026nbsp;\u003cspan\u003eto allocate an array, collection, or byte buffer, with no check against the bytes actually\u0026nbsp;\u003c/span\u003e\u003cspan\u003eavailable. A small crafted input can therefore declare a very large size and force a\u0026nbsp;\u003c/span\u003e\u003cspan\u003emulti-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext\u0026nbsp;\u003c/span\u003e\u003cspan\u003e(header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length,\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewhich could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo\u0026nbsp;\u003c/span\u003e\u003cspan\u003egroup-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde).\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eImpact:\u003c/div\u003e\u003cdiv\u003eAn attacker can trigger the oversized allocation and raise an OutOfMemoryError that crashes the\u0026nbsp;\u003cspan\u003eaffected consumer or Kafka Streams thread; the broker and the rest of the cluster are unaffected.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThe reachable surface depends on the path: writing a crafted record to a Streams application\u0027s\u0026nbsp;\u003c/span\u003e\u003cspan\u003einternal changelog or repartition topics, or committing crafted offset metadata to its consumer\u0026nbsp;\u003c/span\u003e\u003cspan\u003egroup (Streams internal paths); writing a crafted record to any topic that a consumer reads with\u0026nbsp;\u003c/span\u003e\u003cspan\u003eListSerde (ListDeserializer); or, as a member of a Streams consumer group, returning crafted\u0026nbsp;\u003c/span\u003e\u003cspan\u003eassignment data when elected leader (AssignmentInfo). Because a crafted record remains in its\u0026nbsp;\u003c/span\u003e\u003cspan\u003etopic, the error can recur on restart. The record size limit (max.message.bytes) does not help,\u0026nbsp;\u003c/span\u003e\u003cspan\u003ebecause the allocation is driven by a size field rather than by the input\u0027s length.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003c/div\u003e\u003cdiv\u003eUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Where authorization is enabled, restrict write\u0026nbsp;\u003cspan\u003eaccess to each application\u0027s internal topics and consumer group to its own principal, and restrict\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewho can produce to topics that are consumed with ListSerde.\u003c/span\u003e\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eResolution:\u003c/div\u003e\u003cdiv\u003eFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: these deserialization paths validate the declared size\u0026nbsp;\u003cspan\u003eagainst the remaining input before allocating and reject input that fails the check.\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "Several Kafka deserialization paths read a size or count field from input data and use it directly\u00a0to allocate an array, collection, or byte buffer, with no check against the bytes actually\u00a0available. A small crafted input can therefore declare a very large size and force a\u00a0multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext\u00a0(header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length,\u00a0which could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo\u00a0group-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde).\n\n\nImpact:\n\nAn attacker can trigger the oversized allocation and raise an OutOfMemoryError that crashes the\u00a0affected consumer or Kafka Streams thread; the broker and the rest of the cluster are unaffected.\u00a0The reachable surface depends on the path: writing a crafted record to a Streams application\u0027s\u00a0internal changelog or repartition topics, or committing crafted offset metadata to its consumer\u00a0group (Streams internal paths); writing a crafted record to any topic that a consumer reads with\u00a0ListSerde (ListDeserializer); or, as a member of a Streams consumer group, returning crafted\u00a0assignment data when elected leader (AssignmentInfo). Because a crafted record remains in its\u00a0topic, the error can recur on restart. The record size limit (max.message.bytes) does not help,\u00a0because the allocation is driven by a size field rather than by the input\u0027s length.\n\n\nMitigation:\n\nUpgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Where authorization is enabled, restrict write\u00a0access to each application\u0027s internal topics and consumer group to its own principal, and restrict\u00a0who can produce to topics that are consumed with ListSerde.\n\n\nResolution:\n\nFrom Apache Kafka 4.2.2, 4.3.2, and 4.4.0: these deserialization paths validate the declared size\u00a0against the remaining input before allocating and reject input that fails the check."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory allocation with excessive size value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:45:25.163Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://kafka.apache.org/cve-list"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-111551",
    "datePublished": "2026-10-28T16:45:25.163Z",
    "dateReserved": "2026-10-16T11:01:49.270Z",
    "dateUpdated": "2026-10-28T20:06:57.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}